An Overview of Auditing

Auditing enables you to determine which activities are occurring on your system. Through auditing, you can track access to objects, files and folders; as well as any modifications made to the objects, files and folders. Auditing therefore enables you to collect information associated with resource access and usage on your system by allowing you to audit system logon, file access, object access, as well as any configuration changes. An audit trail can be defined as a list of audit entries which portray the life span of an object, or file and folder. When an event or action takes place that's configured for auditing, the action or event is written to the security log. Security auditing events are thus written to the security log of the system, and can be accessed from Event Viewer.

Audit entries in the security log can be one of the following:

• Success event
  
• Failure event
  

The main types of events which you should audit are listed below:

• Computer logons and computer logoffs
  
• Access to objects, and files and folders
  
• System events, such as when the following occurs:
  
  • Computer reboots and computer shutdowns.
    
  • System time is modified
    
  • Audit logs are cleared.
    
• Performance of user and computer account management activities, such as:
  
  • Creating new accounts
    
  • Changing permissions
    
  • Modifying account statuses
    

One of the primary steps in implementing auditing is to create an audit plan which would define the objectives of implementing auditing on your system. The aspects which should be included in your audit plan are:

• List the type of access and information which should be audited.
  
• Determine whether success events, failure events, or both success and failure events should be audited.
  
• Determine the resources which are available for auditing purposes. Resources in this case refers to disk space, and memory and processor usage
  
• Plan the scope of auditing according to the resources which are available for auditing purposes. A wide auditing scope with auditing of both success and failure events can cause a large quantity of data to be collected. This in turn could prevent you from easily finding the information considered important.
  
• Define the quantity of time which would be required to view and analyze audit logs.
  

Auditing of security event categories are disabled by default. In order to track access to objects, and files and folders, you have to define and configure an audit policy. You have to determine the types of events which you want to audit, and include the security requirements of the organization when you configure audit policies. Another step in defining audit policies is to determine the particular event categories which should be audited.

The event categories which you can audit are

• Account logon events: This policy is typically enabled on domain controllers, to track users which are logging on to the computer.
  
• Account management: This policy tracks account management tasks performed on the computer, including creating, changing, and deleting user objects; and changing account passwords.
  
• Directory service access: For domain controllers, the policy tracks when users access Active Directory objects which have system access control lists (SACLs).
  
• Logon events: This audit policy tracks when the user logons and logoffs.
  
• Object access: Tracks when a user accesses operating system components such as files, folders or registry keys.
  
• Policy change: This policy tacks when changes are made to the security configuration settings of the computer, and includes changes made to:
  
  • Audit policies
    
  • Trust policies
    
  • User rights
    
• Privilege use: Tracks when a user effects a user right. The user rights excluded from auditing because of the volume of log entries which they generate are:
  
  • Back Up Files And Directories
    
  • Bypass Traverse Checking
    
  • Create A Token Object
    
  • Debug Programs
    
  • Generate Security Audits
    
  • Replace Process Level Token
    
  • Restore Files And Directories
    
• Process tracking: This audit policy tracks when certain events take place on the computer, such as when a program starts, or a process ends.
  
• System events: This policy tracks the following events:
  
  • The computer restarts, or shuts down.
    
  • Any events that impact the security log or the security of the system.
    

For each of the above mentioned event categories, you can choose between three values when you enable auditing. These values in turn determine the condition for which an audit entry would be created:

• Successes only; an audit entry will be created when a particular event or action successfully finalizes.
  
• Failure only; an audit entry will be created when a particular event or action fails.
  
• Successes and Failures; an entry will be created when the particular event or action successfully finalizes or fails.
  

You can define audit polices for:

• The local computer
  
• A domain controller
  
• A domain
  
• An organization unit (OU)
  

Audit policies can be configured through Group Policy for the entire site, or a domain and OU. You can also configure audit policies for servers and workstations.

You can enable the Security Options policies to secure certain server components from a number of threats and accidents:

• Accounts: Administrator Account Status; enables/disables the local Administrator account of the computer.
  
• Accounts: Guest Account Status; enables/disables the local Guest account of the computer.
  
• Accounts: Rename Administrator Account; defines the alternative name for the security identifier (SID) of the local Administrator account
  
• Accounts: Rename Guest Account; defines the alternative name for the security identifier (SID) of the local Guest account
  
• Audit: Audit The Use Of Backup And Restore Privilege; when the Audit Privilege Use policy is enabled, it configures the computer to audit user privileges.
  
• Audit: Shut Down System Immediately If Unable To Log Security Audits; results in the computer shutting down when no further auditing entries can be written to the security log due to the log reaching its maximum size limit.
  
• Devices: Allowed To Format And Eject Removable Media; defines those local groups which are allowed to format and eject removable NTFS file system media.
  
• Devices: Restrict CD-ROM Access To Locally Logged-on User Only; stops users from accessing the CD-ROM drives of the computer.
  
• Devices: Restrict Floppy Access To Locally Logged-on User Only; stops users from accessing the floppy disk drive of the computer.
  
• Domain Member: Maximum Machine Account Password Age; sets the frequency at which the computer account password of the system is modified.
  
• Interactive Logon: Do Not Require CTRL+ALT+DEL; specifies the Disable option so that users are secured from Trojan horse attacks.
  
• Interactive Logon: Require Domain Controller Authentication To Unlock Workstation; stops the computer from being unlocked through cached credentials.
  
• Microsoft Network Client: Digitally Sign Communications (Always); sets the computer to require packet signatures for Server Message Block client communications.
  
• Microsoft Network Server: Digitally Sign Communications (Always); sets the computer to require packet signatures for Server Message Block server communications.
  
• Network Access: Do Not Allow Anonymous Enumeration Of SAM Accounts And Shares; stops anonymous users from gathering information on the names of local user accounts and shares.
  
• Network Access: Remotely Accessible Registry Paths And Sub-paths; defines the registry paths and sub-paths which certain users can access.
  
• Network Access: Shares That Can Be Accessed Anonymously; defines the shares which can be accessed by anonymous users.
  
• Network Security: Force Logoff When Logon Hours Expire; configures the computer to end any current local user connections that have used up their defined logon hours or time.
  
• Shutdown: Allow System To Be Shut Down Without Having To Log On; enables the Shut Down button in the Log On To Windows dialog box.
  

The information recorded on an event in a security event log is listed below:

• The type of event logged: Error, Warning, or Information, and Success Audit or Failure Audit
  
• The date on which the event occurred
  
• The software or program that logged or recorded the event.
  
• The user that performed the action which resulted in an event being logged.
  
• The computer name on which this action was performed
  
• The event identity number
  
• The event description
  

A few recommendations for auditing security events are summarized below:

• Define an audit plan which details what you want to audit
  
• Configure the security event log size so that it is suitable for the security requirements of the organization
  
• Archive security logs on a regular basis.
  
• Audit both success events and failure events in the System Events category
  

How to define an audit policy on the local computer

1. Click Start, Programs, Administrative Tools, and then click Local Security Policy.
   
2. Expand the Local Policies in the left pane.
   
3. Click Audit Policy.
   
4. The options which you can define audit policy for are listed in the right pane.
   
5. Proceed to select and double-click the desired option.
   
6. When the Properties dialog box for the policy which you have selected opens, enable success audit, failure audit, or both success and failure audits.
   
7. Click OK.
   

How to define an audit policy on the domain controller

1. Click Start, Programs, Administrative Tools, and then click Domain Controller Security Policy.
   
2. Expand the appropriate nodes in the left pane to move to Computer Configuration, Windows Settings, Security Settings, Local Policies, and then Audit Policy.
   
3. Click Audit Policy.
   
4. Proceed to select and double-click the desired option.
   
5. When the Properties dialog box for the policy which you have selected opens, enable success audit, or failure audit, or both success and failure audits.
   
6. Click OK.
   

How to define the event categories to audit for a site, domain, or OU

1. Click Start, Administrative Tools, and then click Active Directory Users And Computers
   
2. In the left console pane, right-click the site, domain, or OU; and then select Properties from the shortcut menu.
   
3. Click the Group Policy tab, add a new policy, and click Edit
   
4. In the Group Policy Object Editor console, in the left console tree, expand Computer Configuration, Windows Settings, Security Settings, Local Policies and then expand Audit Policy
   
5. In the details pane, right-click the particular event category which you want to audit; and then select Properties from the shortcut menu.
   
6. When the Properties dialog box of the event category opens, select one or both of the following options: Success, Failure
   
7. Click OK.
   

How to enable auditing for Active Directory objects.

1. Open the Active Directory Users And Computers console
   
2. Ensure that Advanced Features are enabled on the View menu
   
3. Select the Active Directory object which you want to configure auditing for, and then select Properties on Action menu.
   
4. When the Properties dialog box of the object opens, click the Security tab.
   
5. Click Advanced to move to the Advanced Security Settings For dialog box for the Active Directory object.
   
6. Click the Auditing tab.
   
7. Click Add, and then specify the users or groups for which you want to audit object access.
   
8. Click OK.
   
9. When the Auditing Entry For dialog box for the object appears, choose the event(s) that you want to audit by choosing either one of, or both of the following options: Successful, Failed; alongside the particular event(s).
   
10. Use the Apply Onto list box to set where the auditing should take place. The default setting is This Object And All Child Objects.
    
11. Click OK.
    

How to enable auditing for files and folders

1. Open Windows Explorer.
   
2. Right-click the file or folder which you want to configure auditing for, and then select Properties from the shortcut menu.
   
3. On the Security tab, click Advanced.
   
4. Click the Auditing tab on the Advanced Security Settings For dialog box of the file or folder.
   
5. Click Add, and then choose the users/groups for which you want to audit file or folder access. Click OK.
   
6. In the Auditing Entry For dialog box for the file/folder, select the events that you want to audit by checking either the Successful option, Failed option, or both of these options alongside the particular event(s). You can choose to audit the following events:
   
   • Full Control
     
   • Traverse Folder/Execute File
     
   • List Folder/Read Data
     
   • Read Attributes
     
   • Read Extended Attributes
     
   • Create Files/Write Data
     
   • Create Folders/Append Data
     
   • Write Attributes
     
   • Write Extended Attributes
     
   • Delete Subfolders and Files
     
   • Delete
     
   • Read Permissions
     
   • Change Permissions
     
   • Take Ownership
     
7. Use the Apply Onto list box to specify the location where auditing should occur. The default setting is This Folder, Subfolders And Files.
   
8. Click OK.
   

How to apply an audit policy to Active Directory users and OUs using Group Policy

1. Click Start, Run, enter mmc in the Run dialog box, and click OK.
   
2. Using the File menu, click Add Snap in, and then click Add.
   
3. Select the Group Policy Object Editor management tool and then click Add.
   
4. When the Select Group Policy Object dialog box opens, click Browse to choose the proper GPO for the specific domain or OU.
   
5. In the left pane, expand Computer Configuration, Windows Settings, Security Settings, and then expand File System to set a audit policy for the file system
   
6. Right-click the File System node to add audit settings for a file/folder.
   
7. Using the browse interface, locate the file/folder for which you want to configure auditing.
   
8. Click Edit Security to specify the auditing settings.
   

How to access Event Viewer to view security log information

1. Click Start, Programs, Administrative Tools, and then click Event Viewer
   

How to view information in the security log through Event Viewer

1. Open Event Viewer
   
2. In the console tree in the left pane, click Security
   
3. The details pane is populated with all events that exist in the security log, together with summary information such as Date, Time, Category, Event ID, and User; on each entry.
   
   • A key icon is displayed alongside successful audit events.
     
   • A lock icon is displayed alongside unsuccessful audit events.
     
4. You can double-click on an event entry to view its properties.
   

How to filter events in the security log

1. Open Event Viewer
   
2. In the console tree in the left pane, click Security
   
3. On the View menu, click the Filter option.
   
4. On the Filter tab, specify the filter criteria that you want to use to display a specific event(s) in the security log.
   
5. In the Event Types section of the dialog box, specify the types of events tht you want to display in the security log.
   
6. In the Event Source list, choose the source that logged the event(s) which you want to display.
   
7. In the Category list, choose the event category.
   
8. In the Event ID box, enter the event identity number
   
9. In the User box, enter the user name
   
10. In the Computer box, enter the computer name.
    
11. Use the From list boxes to enter the start parameters for the events which should be filtered.
    
12. Use To list boxes to enter the end parameters for the events which should be filtered.
    
13. Click OK to display the filtered events in the security log.
    
14. Clicking the Restore Defaults button on the Filter tab removes the security log filter.
    

How to configure the size of the security event log

1. Open Event Viewer
   
2. In the console tree in the left pane, right-click Security and then select Properties on the shortcut menu.
   
3. When the Security Properties dialog box opens, on the General tab, enter the maximum log file size. The default setting is 512 KB. You can set the maximum log file size to any size from 64 KB to 4,194,240 KB.
   
4. Choose one of the following options listed beneath the When Maximum Log File Size Is Reached section of the dialog box:
   
   • Overwrite Events As Needed: When selected, the oldest events in the security log are replaced when new events need to be logged.
     
   • Overwrite Events Older Than _ Days: Enter the number of days after which the system can overwrite an event.
     
   • Do Not Overwrite Events (Clear Log Manually): When selected, you have chosen to manually clear the security log. The system does not overwrite or replace any events in the security log when the maximum log file size is reached. If the security log is not manually cleared, all new events are dropped, and are therefore not recorded in the security log.
     

How to clear the security log

1. Open Event Viewer
   
2. In the console tree in the left pane, right-click Security and then select Clear All Events on the shortcut menu.
   
3. When the Event Viewer message box appears, click Yes to archive the existing entries in the security log prior to it being cleared; or click No to simply delete the existing entries in the log.
   
4. If you chose to archive the entries in the security log, enter a name and a file format for the log file.
   
5. Click Save.
   

How to archive a security log

1. Open Event Viewer.
   
2. In the console tree in the left pane, right-click Security and then select Save Log File on the shortcut menu.
   
3. Enter a name for the file and then enter a file format for the file.
   
4. Click Save.
   

Backing Up and Restoring the WINS Database

Protecting the WINS database

To protect your WINS databases from disasters and corruption, you should regularly back up your WINS databases.
The methods which you can use to back up the WINS database are:

You can use the WINS console to perform:

• A manual back up of the WINS database
• Schedule an automatic backup of the WINS database.

1. You can use the ntbackup.exe utility to back up the WINS database. The Windows Server 2003 Volume Shadow Copy feature allows you to back up the WINS database while it is online. In previous Windows versions, you first had to stop the WINS service before you could start backing up the database.
2. Back up the WINS database from the command-line, using the netsh.exe command line utility.

If you have backed up the WINS database, you can restore a previously backed up version when the existing WINS database becomes corrupt, or is lost.

1. You can use the WINS console to restore a previously backed up WINS database.
2. You can also use the netsh.exe command-line utility if you want to restore the database from the command-line.

How to manually back up the WINS database

1. Click Start, Administrative Tools, and then click WINS to open the WINS console.
2. In the console tree, right-click the WINS server whose database you want to back up, and then select Back Up Database from the shortcut menu.
3. The Browse For Folder dialog opens.
4. If you want to create a new folder to store the WINS database backup, click the Make New Folder button. Provide a name for the new folder.
5. If you want to store the WINS database backup in an existing folder, browse to the particular folder.
6. Click OK to start backing up the WINS database.
7. Click OK when a message appears, indicating that the database back up was completed successfully.

How to schedule an automatic backup of the WINS database

1. Click Start, Administrative Tools, and then click WINS to open the WINS console.
2. In the console tree, right-click the WINS server whose database you want to schedule for an automatic backup, and then select Properties from the shortcut menu.
3. On the General tab, specify the path (location) for the automatic backup in the Default Backup Path box.
4. Select the Back up database during server shutdown checkbox.
5. Click OK.

How to enable Volume Shadow Copy to perform an online back up of the WINS database

1. Click Start, My Computer, and then click Open
2. Right-click the particular system volume, and then select Properties from the shortcut menu.
3. The system volume Properties dialog opens.
4. Click the Shadow Copies tab.
5. Select the system volume in the Select A Volume: box, and click the Enable button.
6. Click Yes to the warning message that is displayed, to continue enabling the Volume Shadow Copy feature.
7. Once Volume Shadow Copy is enabled, you can run ntbackup to back up the WINS databases while they are online.

How to back up the WINS database from the command-line

You can use the netsh.exe command line utility to back up the WINS database from the command line.

The command syntax for backing up the WINS database is:
netsh wins winsserver init Backup Dir=c:backupdir Type=0

• winsserver, is name of the WINS server
• c:backupdir, is location for the back up. 
• Type=0, indicates full backup, Type=1 indicates incremental backup

How to restore the WINS database using the WINS console

1. Click Start, Administrative Tools, and then click WINS to open the WINS console.
2. I the console tree, right-click the WINS server whose database you want to restore, and select All Tasks, and then select Stop from the shortcut menu. The WINS service has to be stopped before any database restores can be performed.
3. In the console tree, right-click the WINS server again and then select Restore Database from the shortcut menu.
4. The Browse For Folder dialog opens.
5. Navigate to the location of the folder which was used to store the previous WINS database backup.
6. Click OK.
7. WINS proceeds to restore the database.
8. The WINS service is automatically restarted.

 

How to restore the WINS database from the command-line

1. The command syntax for restoring the WINS database is:
2. netsh wins winsserver init Restore Dir=c:backupdir Type=0
3. winsserver, is name of the WINS server
4. c:backupdir, is location that must be used for the restore

Short note on Alg.exe

Alg.exe represents the Application Layer Gateway Service and it is a component of Microsoft Windowsoperating system. It is an essential process and it’s required for the Internet Connection Sharing and the Windows Internet Connection Firewall. Upon execution, alg.exe calls a number of DLLs and processes for initialization of the Internet Connection Firewall and the Microsoft Windows Internet Connection. Alg.exe is essential for secure and stable running of computer and so, it should not be terminated.

Alg.exe allows an individual to use third-party protocol plugins on the system. So, if you use a third-party firewall then you should not remove this process. Also, if you use Internet Connection Sharing or Windows Firewall then you should not remove this process as removing it causes you to lose the network connectivity until the next system reboot. In addition to this, other network-related software also need alg.exe for their proper functioning

.

Only one copy of alg.exe is available in memory at any given time and if you see more than one copy of alg.exe then you’re most likely to have a spyware or a virus on your system. You can use the Task Manager to check how many copies of alg.exe are available in memory. Also, another important point regarding alg.exe is that ‘Local Service’ usually appears as the user name for it and if there’s an instance of alg.exe with a different user name then it could be a malware.

how to setup Connection Manager in windows

Connection Manager is versatile client dialer and connection software that you can customize by using the Connection Manager Administration Kit (CMAK) wizard. The CMAK wizard provides defaults that support quick and easy creation of a basic Connection Manager service profile. If you want to use all of the defaults and do not want to take advantage of the many customizable elements, you probably do not need this documentation.

However, if you want a custom dialer that promotes your brand and supports more advanced functions, such as automatic phone book updates and support for virtual private networking, you need this documentation to help you effectively plan and implement your custom elements.

Before you run the Connection Manager Administration Kit (CMAK) wizard, you should plan and develop the Connection Manager custom elements that you want in your client dialer. Then, simply run the CMAK wizard, answering the questions and providing the information about your custom elements. The CMAK wizard then builds a service profile, which is a set of files which you distribute to your users so that they can easily install and run your custom version of Connection Manager.

Using the connection manager an administrator can create a custom remote access client connection for the corporate user which has all the necessary settings predefined. This client connection can be created using the CMAK or Connection Manager Administration Kit, which is basically a wizard based step-by-step process of building a custom remote access client package. An administrator can add any levels of customer elements to sophisticate the client package which can later be installed on the user’s computer.

Connection Manager requires at least 2 megabytes (MB) of free disk space and one of the following:

Windows 95 

Windows 98 

Windows NT Workstation 4.0 

Windows 2000 

Windows Millennium Edition 

Windows XP 

Windows Server 2003 family 

Internet Explorer 4.01, 5.0, 5.5, or 6.0. Users do not have to have Internet Explorer set as their default browser or use the software. 

Disk-space requirements for each system vary, based on the elements included in the service profile.

For dial-up connections, Connection Manager also requires a 28.8 modem or faster connection. Connection Manager can automatically configure the modem. If you include Connection Manager in the service profile, the user’s modem is configured as needed to support Connection Manager.

How to Setup a Remote Desktop Web Connection

The Remote Desktop Web Connection is a Win32-based ActiveX control (COM object) that can be used to run Remote Desktop sessions from within a browser like Internet Explorer. It is a useful alternative to the regularRemote Desktop because it can be used without installing any software on the client machine. Remote Desktopdemands the user to install software on the client’s machine, which can be sometimes infeasible.

Remote Desktop Web Connection is able to do this because the Remote Desktop runs within a web browser such as Internet Explorer. The web browser on the host computer must support Active-X controls to implement Remote Desktop Web Connection.

Configuring the Host Computer

Enabling the Remote Desktop Web Connection on the host computer is the foremost step. Follow the steps listed below carefully

:

Open Control Panel, click on the Add or Remove Programs icon, and then click on Add/Remove Windows Components option. 

Click on Internet Information Services, and then click on the Detailsoption. 

In the Subcomponents of Internet Information Services list, click on World Wide Web Service, and then click on the Details option. 

In the Subcomponents of World Wide Web Service list, select the Remote Desktop Web Connection check box, and then click OK. 

In the Windows Components Wizard, click on Next. 

Click Finish when the wizard has completed. 

Configuring IIS (Internet Information Services)

TCP port number 80 acts as the default port number to identify Internet Information Services (IIS). In order to avoid external harmful attacks, these steps change the default port number. The steps listed below are optional but implementing them will highly improve your machine’s security.

Note: TCP port number should not be changed if you are already using the machine as a web server.

Open Control Panel, click on the Performance and Maintenance icon, and then click onAdministrative Tools. Double-click on the Internet Information Services. 

In the ISS snap-in, expand your computer name, expand Web Sites, right-click on theDefault Web Site, and then click on Properties. 

On the Web Site tab, change the TCP Port value. Enter a number between 1000 and 65535 that you remember well. This port number will be used for future connections. 

Click OK, and close the Internet Information Services snap-in. 

Configuring Remote Desktop

A user account with a password is necessary to connect using Remote Desktop. Create an account if you do not have one. Follow the listed steps carefully to activate Remote Desktop

Right-click on My Computer from the desktop, and select the Properties option. 

Select the Remote tab, and then click on the Allow users to connect remotely to this computer check box. 

Click Select Remote Users, and then click Add. 

In the Select Users dialog box, type the name of the user and then click on OK. Click onOK again to return to the System Properties dialog box, and then click on OK to close it. 

Connect to the Remote Computer

Finally, you can now connect to the remote configured computer via the Internet. In order to connect, the IP address of the target computer should be known (you could use What Is My IP or What Is My IP.com to identify the IP address). Now, simply follow the listed steps carefully in order to connect:

Open Internet Explorer browser, and enter the URL http://ipaddress:port/tsweb/

Example: http://192.168.1.120:1374/tsweb/ 

Your browser may not be installed with the Remote Desktop ActiveX control, hence if it prompts you to install it, click Yes. 

On the Remote Desktop Web Connection page, click on Connect. You don’t need to fill in the Server field. If you leave the Size field set to Full-screen, the remote desktop will take over your local desktop. 

Enter your user name and password at the Windows logon prompt, and then click OK. You’ll see your desktop completely.

How to Configure NTFS Quotas

Use disk quotas to manage storage growth in distributed environments. Disk quotas allow you to allocate available disk space to users based on the files and folders that they own. Windows 2003 disk quotas track and control disk space usage on a per-user, per-partition basis.

Characteristics of Windows 2003 Server Disk Quotas

• Disk usage is based on file and folder ownership. When a user copies or saves a new file to an NTFS partition or takes ownership of a file on an NTFS partition, windows 2003 changes the disk space for the file against the user's quota limit.
• Disk quotas don't use disk compression. Users are changed for each uncompressed byte, regardless of how much hard disk space is actually needed.
• Free space for applications is based on the Quota limit. When you enable disk quotas, the free space that windows 2003 reports to applications for the partitions is the amount of space remaining within the users quota limit.
• Windows 2003 track disk quota independently for each NTFS partition, even if the partitions reside on the same physical hard disk.

Enforcing Disk Quotas for All Users

To enforce quota limits for all users, perform the following:

• In the limit disk space set warning level to boxes, enter the values for the limit and warning level that you want to set.
• Select the deny disk space to users exceeding quota limit check box.

Setting Disk Quotas for Individuals:

• In the properties dialog box for a disk on the quota tab click the Quota Entries button.
• In the Quota Entries for dialog box create an entry by clicking New quota entry on the quota menu and then selecting a user.
• Configure the Disk space limit and the warning level for the individual user.

NTFS Permissions after Copying or Moving Files

When copying or moving a file or folder, the permissions may change depending on where you move the file or folder.

Copying Files and Folders

When copying folder or files from one folder to another folder or from one partition to another partition, permissions for this files or folders may change.

1. When copying a folder or file within same NTFS partition, the copy of the folder or file inherits the destination folder permissions.
2. When copying a folder or file between different NTFS partitions, the copy of the folder or file inherits the destination folder permissions.
3. When copying folders or files to non NTFS partitions such as File Allocation Table (FAT), the files or folders will lose their all NTFS permissions.

Note: To copy folders and files within same NTFS partition or between NTFS partitions, you must have read permissions for the originating folders and for the destination folder you should have write permission.

Moving Files and Folders

When moving a file or a folder, permissions may get changed depending on the destination folder permissions.

1. When moving a file to a folder within the same NTFS partition, the folder or file will retains its original permissions.
2. When moving a folder or file between different NTFS partitions, the file or folder will inherit the destination folder permissions.
3. When moving files to folders on NTFS partitions to non NTFS partitions the folders and files will lose their all NTFS permissions, as NTFS permissions are not supported by non NTFS partitions.

Note: To move folders and files within an NTFS partitions you must have both permissions, for the destination folder you should have write permission and modify permissions for source file or folder to configure the options. You need to have modified permission for folder or file to move as Windows 2000 will remove the file or folder from the main folder after copying it to the folder destination.

NTFS File Compression

One feature available when you format a volume with the NTFS file system is file compression. NTFS compression can only be applied to a partition or volume that is formatted with the NTFS file system. Through NTFS, you can create additional storage space for files by compressing either single files, or all files in a NTFS folder. Files in a compressed folder are compressed when folder compression is enabled. Any subfolders included in the compressed folder can also be compressed. You can also compress all files on NTFS volumes. A compressed file is automatically uncompressed when it is accessed. The section of the file being read is the section of the file that is uncompressed. The remainder of the data of the file remains uncompressed in memory. When the file is saved to memory or written to disk, NTFS compresses any new data in the file.

With Windows Server 2003, you can compress files that have any length. The only requirement being that the $Data attribute is non-resident. NTFS file compression is available only when your cluster size is 4KB or less on a NTFS volume. The NTFS file compression feature cannot be utilized on files that are encrypted.

The NTFS compression algorithm used in NTFS 1.2, NTFS 3.0 and NTFS 3.1 are the same. You can therefore access compressed files from Windows NT 4.0, Windows 2000 and Windows Server 2003.

While DoubleSpace, DriveSpace and DriveSpace 3 compression compresses the entire volume, NTFS compression can be restricted to compressing only files, or folders. You do not need to compress the entire volume. NTFS is also faster than the other just mentioned compression techniques. Because Windows Server 2003 is unable to read DriveSpace volumes, you have to decompress these volumes before attempting to upgrade a Windows 9x or Windows Me desktop.

You should generally refrain from compressing database files, and from enabling compression on a server. The reason is that compressed files tend to be excessively fragmented, and the defragmenter cannot optimally defragmenter volumes that are compressed.

You can use Windows Explorer or My Computer to enable compression or change the compression state of an NTFS volume, or the compression state of individual files or folders on NTFS volumes. You can also use the COMPACT command line tool to compress or decompress files.

How moving or copying a file or folder affects a file’s compression state

When you move or copy files and folders between NTFS volumes or to or from File Allocation Table (FAT) partitions, the file’s compression state can change.

• When you move an uncompressed file or folder on a NTFS volume or partition to a different location on the same NTFS volume, the files or folder stays uncompressed.
• When you move or copy a compressed file or folder from a NTFS partition to a non-NTFS partition such as a FAT partition, the file or folder is decompressed on the non-NTFS partition.
• When you copy a compressed file or folder from a NTFS volume or partition to a different location on the same NTFS partition, the file or folder inherits the compression state of the new folder location.
• When you copy a compressed file or folder from a NTFS volume or partition to a location on a different NTFS partition, the file or folder inherits the compression state of the new folder location.
• When you move a compressed file or folder on a NTFS volume or partition to a location on the same NTFS partition, the file or folder keeps its previous compression state.
• When you move a compressed file or folder on a NTFS volume or partition to a location on a different NTFS volume, the file or folder inherits the compression state of the new folder location.

How to enable compression or change the compression state of an NTFS volume

1. Open Windows Explorer
2. Right-click the volume which you want to compress or uncompress, and then select Properties from the shortcut menu.
3. When the Properties dialog box of the volume is displayed, you use the General tab to change the compression state of the NTFS volume.
4. You can either select the Compress drive to save disk space checkbox to enable compression, or clear the Compress drive to save disk space checkbox to disable compression.
5. Click OK
6. When the Confirm Attribute Changes dialog box appears, choose to either apply compression to the NTFS volume or to apply compression to the root folder.

How to enable compression or change the compression state of a folder on a NTFS volume

1. Open Windows Explorer
2. Locate and right-click the folder that you want to enable compression for, and the choose Properties from the shortcut menu.
3. When the Properties dialog box of the folder opens, click the Advanced button.
4. Select the Compress drive to save disk space checkbox to enable compression for the folder. You can alternatively clear the Compress drive to save disk space checkbox to disable compression for the folder.
5. Click OK
6. When the Confirm Attribute Changes dialog box is displayed, select one of the following option:
   • Apply changes to this folder only
   • Apply changes to this folder, subfolders, and files
7. Click OK

How to enable compression or change the compression state of a file on a NTFS volume

1. Open Windows Explorer
2. Locate and right-click the file that you want to enable compression for, and the choose Properties from the shortcut menu.
3. When the Properties dialog box of the file opens, click the Advanced button.
4. Select the Compress drive to save disk space checkbox to enable compression for the file. If you want to disable compression for the particular file, clear the Compress drive to save disk space checkbox.
5. Click OK

How to change the display colors of compressed files and folders

1. Using Windows Explorer, or My Computer, click the Tools menu, and select Folder Options.
2. When the Folder Options dialog box opens, click the View tab.
3. Select the Show encrypted or compressed NTFS files in color option.
4. Click OK
5. Windows will now display the names of all compressed files and folders in blue.

Volume Shadow Copies Overview

Volume shadow copies, a new Windows Server 2003 feature, are used to create copies of files at a specific point in time, or set time interval. Shadow copies can only be created on NTFS volumes to create automatic backups of files or data per volume. When enabled, the Shadow copies feature protects you from accidentally losing important files in a network share. Remember that when users delete files from over the network, those files are permanently deleted. Because shadow copies enable users to view previous versions of files, the feature allows them to restore a backup of deleted files.
A few advantages of enabling volume shadow copies on shared folders are:

• If volume shadow copies are enabled for shared folders, you can restore or recover files which have been accidentally deleted or which have become corrupt. The prior versions of files can be copied to the same location, or to another location.
  
• Through volume shadow copies, you can recover files which have been overwritten when you need to use a previous version of the file.
  
• Volume shadow copies also enable you to compare changes between a current version of the file and a previous version of the file.
  
• The integrity of the previous file versions are maintained because they are read-only copies, thereby preventing any user from changing a file which was shadow copied. If users need to change a previous version of a file, they have to copy the version to a different location, and then perform the necessary changes.
  

As mentioned previously, you can only configure volume shadow copies on NTFS volumes. The shadow copies feature is in fact a new NTFS feature introduced with Windows Server 2003. Shadow copies are used to create shadowed copies of files, at a specified point in time and on a per volume basis, which means that you basically configure shadow copies at the volume level. You cannot therefore specify only certain files and folders for volume shadow copies.
The main requirements for enabling the shadow copies feature are:

• Shadow copies must be configured on NTFS volumes, and on a per volume basis.
  
• The NTFS volume that you want to configure for volume shadow copies must have 100MB of free volume space (minimum requirement). The maximum is 10% of the volume's free disk space, by default.
  

A few important points to consider when working with shadow copies are:

• Each volume enabled for shadow copies can only store 64 shadow copies. When this limit is reached on a volume, the oldest shadow copy is permanently deleted, and cannot be restored. You can therefore only view a maximum of 64 previous versions of files.
  

• Shadow copies should not be utilized to replace performing regular backups, but should be used to enhance the backup strategy of your organization.
  

Configuring Shadow Copies

To enable shadow copies on a volume,

• You must be a member of the Administrators group on the local machine.
  
• Shadow copies must be enabled on the server.
  
• For clients to access shadow copies, they need to have the Previous Versions Client software installed. The software can be found in the %windir%system32clientstwclient folder.
  
• The software can be distributed or deployed via Group Policy, Systems Management Server (SMS), or you can create a share so that clients can download the necessary software.
  

You can enable shadow copies through the Computer Management console which can be accessed through the Administrative Tools folder. Shadow copies are enabled from the Shared Folders folder in the left pane of the Computer Management console. To navigate to the Shared Folders folder, expand System Tools. To open the Shadow Copies dialog box, right-click Shared Folders, select All Tasks, and then click the Configure Shadow Copies option on the shortcut menu. This is the location where you manage and configure the volume shadow copies feature.
Te Shadow Copies dialog box is made up of the following panes:

• The uppermost pane of the Shadow Copies dialog box is where you enable shadow copies for the particular volume.
  
  • To enable shadow copies, click the Enable button.
    
  • If you do not want a volume to use shadow copies, click the Disable button.
    
  • To change the configuration settings of existing enabled shadow copies, click the Settings button to open the Settings dialog box. The Settings dialog box is divided into the following two sections:
    
    • Storage Area: This is where you change the storage location of shadow copies, and the amount of space used to store shadow copies.
      
    • Schedule: This where you configure how often, or when shadow copies are to be created.
      
    The settings which you can configure for enabled shadow copies on the Settings dialog box are:
    
    • Location on this volume drop-down list box: This drop-down list box is used to specify the volume on the server on which the shadow copies are to be stored. In cases where only one volume exists, then this is the volume which is automatically selected, and you are unable to select other volumes.
      
    • Details button: Click this button to view information on the disk space available, and the total disk space.
      
    • Maximum Size – No limit option: To specify that unlimited disk space can be used to store shadow copies, click the No limit option under the Maximum Size option.
      
    • Maximum Size – Use Limit option: To specify the disk space which can be used to store shadow copies, click the Use Limit option under the Maximum Size option, and then set how much disk space, in megabytes (MB) can be used to store shadow copies.
      
    • Schedule button: To specify the interval when shadow copies are created, click the Schedule button. The intervals which can be set for when shadow copies are created are
      
      • Daily
        
      • Weekly
        
      • Monthly
        
      • Once
        
      • At System Startup
        
      • At Logon
        
      • When idle
        
  • The bottom pane of the Shadow Copies dialog box displays a list of all the existing shadow copies which have been created.
    

    How to enable shadow copies

  • Click Start, Programs, Administrative Tools, and then click Computer Management.
    
  • Expand the System Tools node in the left pane of the console to navigate to the Shared Folders folder.
    
  • Right-click Shared Folders, select All Tasks, and then select Configure Shadow Copies from the shortcut menu.
    
  • The Shadow Copies dialog box opens next.
    
  • Choose the specific volume for which you want to enable shadow copies, and then click the Enable button.
    
  • The Enable Shadow Copies message box displays, prompting you to verify that shadow copies should be enabled for the particular volume. The message also informs you that the default settings will be utilized for the particular shadow volume. Click Yes to continue with enabling shadow copies.
    
  • After you have enabled shadow copies, click the Settings button on the Shadow Copies tab to configure settings for the shadow copies.
    
  • Select either the Maximum Size option's No Limit option, or the Use Limit option to configure the disk space which can be used to store shadow copies.
    
  • Click the Schedule button to create a schedule which defines when shadow copies are created.
    
  • Click New in the dialog box that opens to define a new schedule for the shadow copies.
    
  • From the Schedule Task drop-down list box, choose one of the following intervals:
    
    • Daily
      
    • Weekly
      
    • Monthly
      
    • Once
      
    • At System Startup
      
    • At Logon
      
    • When idle
      
  • The default schedule used to create the shadow copies specifies that they are created Monday – Friday, two times a day (7:00 A.M. and 12:00 P.M)
    
  • After you have configured the schedule for the shadow copies, click OK.
    
  • To close the Shadow Copies dialog box, click OK.
    

    How to manually create the first shadow copy

  • Click Start, Programs, Administrative Tools, and then click Computer Management.
    
  • To connect to the computer which you want to work with, right-click Computer Management in the left pane, and select Connect To Another Computer on the shortcut menu.
    
  • When the Select Computer dialog box opens, select the computer.
    
  • In the left pane, expand the Storage Node, and select Disk Management.
    
  • All the volumes on the computer are listed in the details pane.
    
  • Right-click the appropriate volume, and click Properties on the shortcut menu.
    
  • On the Shadow Copies tab, using the Select A Volume listing choose the volume, and then click the Settings button.
    
  • Configure all necessary configuration settings for the shadow copies on the Settings dialog box, and click OK.
    
  • On the Shadow Copies tab, click the Create Now button to force the creation of the first shadow copy.
    
  • Click OK.
    

    How to install the client software for shadow copies

  For clients to access shadow copies, they need to have the Previous Versions Client software installed. The software can be found in the %windir%system32clientstwclient folder. You can use one of the methods listed below to install the Previous Versions Client software through a Windows Installer Package on client computers:
  
  • Double-clicking the Windows Installer Package launches a wizard which allows the user to install the Previous Versions Client software.
    
  • You can use the software deployment feature of Group Policy to install the software for client computers.
    
  • You can create a share, copy the Windows Installer Package to the shared folder, and inform clients to download the necessary software.
    
  • You can use Systems Management Server (SMS).
    

    How to access previous versions of a file

  To access previous versions of a file, access the Properties of the particular folder or file through a shared folder, and then select the Previous Versions tab. The Previous Versions tab lists the previous versions of the file. This Previous Versions tab is only displayed if you have enabled the shadow copies feature on the particular server, and if you access the Properties of the particular folder or file through a shared folder. You cannot view the Previous Versions tab if the file is located on the local hard drive.
  The tasks which can be performed from the Previous Versions tab are:
  
  • To view a read-only previous version of a specific file, click the View button on the Previous Versions tab.
    
  • To copy a previous version of a particular file to a different location, click the Copy button on the Previous Versions tab. When the Copy Items dialog box opens, specify the location to which you want to copy the previous version of the file.
    
  • To replace the current version of a particular file with a previous version of the file, click the Restore button on the Previous Versions tab. Click Yes, to the message which appears, warning you that current version the file will be replaced with this particular previous version of the file.
    
  To access shadow copies from a client that has the Previous Versions Client software installed,
  
  • Open Windows Explorer.
    
  • Right-click the particular network share, and then click Properties from the shortcut menu.
    
  • Click the Previous Versions tab.
    
  • Click the previous version which you want to work with, and then select one of the following buttons:
    
    • Click View to view a previous file version.
      
    • Click Copy to copy the shadow copy to a different location.
      
    • Click Restore to replace the existing version with a previous version.
      

      How to install the Previous Versions Client software and view files from shadow copies

  • Open Windows Explorer.
    
  • Navigate to the system32clientstwclient folder on the server to access the Windows Installer package.
    Double-click the Windows Installer package.
    
  • The Previous Versions Client Wizard launches next.
    
  • On the initial page of the Wizard, click Next to install the Previous Versions Client software.
    
  • Once the Previous Versions Client software is installed, access the Properties of the particular folder or file through a shared folder.
    
  • Click the Previous Versions tab.
    
  • Choose the previous version of the file that you want to work with, and click the View button.
    

    How to delete a shadow copy

  • Click Start, Programs, Administrative Tools, and then click Computer Management.
    
  • To connect to the computer which you want to work with, right-click Computer Management in the left pane, and select Connect To Another Computer on the shortcut menu.
    
  • When the Select Computer dialog box opens, select the computer.
    
  • In the left pane, expand the Storage Node, and select Disk Management.
    
  • All the volumes on the computer are listed in the details pane.
    
  • Right-click the appropriate volume, and click Properties on the shortcut menu.
    
  • On the Shadow Copies tab, using the Select A Volume listing choose the volume.
    
  • The Shadow Copies Of Selected Volume area displays all the shadow copies of the volume which you have selected.
    
  • Select the shadow copy that must be deleted, and click the Delete Now button.
    

    How to disable shadow copies

  • Click Start, Programs, Administrative Tools, and then click Computer Management.
    
  • To connect to the computer which you want to work with, right-click Computer Management in the left pane, and select Connect To Another Computer on the shortcut menu.
    
  • When the Select Computer dialog box opens, select the computer.
    
  • In the left pane, expand the Storage Node, and select Disk Management.
    
  • Right-click the appropriate volume, and click Properties on the shortcut menu.
    
  • On the Shadow Copies tab, using the Select A Volume listing select the volume, and then click the Disable button.
    
  • Click Yes to verify that you want to disable shadow copies.
    

    How to manage shadow copies from the command-line

  Shadow copies can also be managed from the command-line. The Vssadmin command which is used and its associated parameters are:
  vssadmin [Add ShadowStorage] [Create Shadow] [Delete Shadow] [Delete Shadow Storage] [List Providers] [List Shadows] [List ShadowStorage] [List Volumes ] [List Writers] [Resize ShadowStorage]
  
  • Add ShadowStorage; sets the location where the shadow copies should be stored for a particular volume.
    
  • Create Shadow; to force the creation of a shadow copy.
    
  • Delete Shadow; to delete a particular shadow copy.
    
  • Delete Shadow Storage; to delete the link between a volume and the location that stores the shadow copies.
    
  • List Providers; to list the shadow copy providers.
    
  • List Shadows; to list all shadow copies.
    
  • List ShadowStorage; to list the volume locations that store shadow copies.
    
  • List Volumes; to list the volumes that have the shadow copies feature enabled.
    
  • List Writers; to list all applications using shadow copies.
    
  • Resize ShadowStorage; to change the space available for storing shadow copies.
    

    Shadow Copies Best Practices

  The factors to remember when working with shadow copies, and a few shadow copies best practices are summarized below:
  
  • Shadow copies should not be utilized as a replacement for regular backups. You should therefore continue to perform regular backups of the system.
    
  • Shadow copies should not be utilized on dual boot computers because a previous version could become corrupted if the computer is booted to an operating system OS which is not Windows Server 2003. Enable shadow copies on computers running only Windows Server 2003.
    
  • Be careful when determining the amount of hard disk space needed for shadow copies. If you configure the limit too small, you could have an insufficient quantity of shadow copies created.
    
  • When shadow copies are enabled, remember that mounted drives are excluded when shadow copies are created.
    
  • When you define the schedule for shadow copies, base it on when users make changes to files. For instance, it would be unnecessary to schedule shadow copies to be created over the weekend if files are not modified during this time frame.
    
  • It is recommended to not schedule shadow copies to take place at an interval greater than once per hour. The interval or frequency for which you configure shadow copies to be created affects how space is utilized.
    
  • You have to restore a shadow copy to change the contents of a shadow copy.
    
  • A file that is restored keeps its file permissions.
    
  • If you recover a deleted file, the file's permissions are the default permissions of the directory.
    
  • Before you disable shadow copies on a volume, delete the shadow copies schedule.
    

Active Directory Authentication Types

The two types of authentication are Mutual Authentication and NTLM. Mutual Authentication requires both the server and the client to identify them. NTLM only requires the client to be validated by the server.


Two types of authentication are Mutual Authentication and NTLM Authentication.

Mutual AuthenticationMutual Authentication is a security feature in which a client process must prove its identity to a server, and the server must prove its identity to the client, before any application traffic is sent over the client-to-server connection. Identity can be proved through a trusted third party and use shared secrets, as in Kerberos v5, or through cryptographic means, as with a public key infrastructure.

Support for mutual authentication is provided by the security support provider interface (SSPI) and is exposed directly through the SSPI APIs and services that layer upon SSPI, including RPC and COM+.

Not all security packages available to SSPI, or all services running Windows 2000 or later, support mutual authentication. An application must request mutual authentication and a supporting security package to obtain mutual authentication.

NTLM
NTLM authentication supports three methods of challenge/response authentication:LAN Manager (LM)
This is the least secure form of challenge/response authentication. It is available so that computers running Windows 2000 or later can connect in share level security mode to file shares on computers running Microsoft Windows for Workgroups, Windows 95, or Windows 98.

 
NTLM version 1

This is more secure than LM challenge/response authentication. It is available so that clients running Windows 2000 or later can connect to servers in a Windows NT domain that has at least one domain controller that is running Windows NT 4.0 Service Pack 3 or earlier.

NTLM version 2

This is the most secure form of challenge/response authentication. It is used when clients running Windows 2000 or later connect to servers in a Windows NT domain where all domain controllers have been upgraded to Windows NT 4.0 Service Pack 4 or later. It is also used when clients running Windows 2000 or later connect to servers running Windows NT in a Active Directory domain.

WINS (Windows Internet Name Server)

In the Windows Server family, the primary means for client computer to locate and communicate with other computers on a internet Protocol (IP) network is by using Domain Name System (DNS). However, clients that use older versions of Windows, such as Windows NT 4.0, use network basic I/O system (NetBIOS) names for network communication. Some applications that run on Windows Server 2003 may also use NetBIOS names for network communication. Using NetBIOS names requires a method of resolving NetBIOS names to IP addresses.


One can implement Windows Internet Name Service (WINS) in a Windows Server 2003 network to ensure that clients using the older versions of Windows can locate and communicate with network resources as needed. One can use WINS both to register NetBIOS names and to resolve those names to IP addresses.


The WINS service resolves NetBIOS names, which reduces broadcast traffic and enables clients to resolve the NetBIOS names of computers that are on different network segments (subnets).
Components of WINS


The complete Windows Server 2003WINS system includes the following components:
WINS Server: a computer that processes name registration requests from WINS clients, registers the client's name and IP addresses, and responds to NetBIOS name queries that clients submit. The WINS server then returns the IP address of a queried name, if the name is listed in the server database.
WINS database: the WINSdatabase stores and replicate the NetBIOS name to IP address mappings for a network.
WINS Client: computers that are directly pointing to a WINS server to register their NetBIOS name and to communicate with other computers registered with same WINS server on that network.
WINS proxy agents: a computer that monitors broadcast for name query and give responds for all those names which are not located on the local subnet. WINS server communicates with the proxy for resolving names and then it caches the names for a particular time period.

NetBIOS Node Types

A NetBIOS node type is a method that a computer uses to resolve a NetBIOS name into an IP address. A NetBIOS node type allows an administrator to configure the order and method that a client uses when resolving NetBIOS names to IP addresses.

Understanding how the various node types function will help users to properly configure their WINS solution. Windows Server supports the following node types:

• B-node (broadcast): it uses broadcasts for name resolution and registration. In a large network, a broadcast increases the network’s load. In addition, routers usually stop all broadcasts to forward, so only computers within the local network will respond.
• P-node (peer-to-peer): it uses a NetBIOS name server such as WINS to resolve NetBIOS names. P-node does not work with broadcasts because it directly queries the name server, enabling computers to resolve NetBIOS names across routers. P-node requires all computers to be configured with the NetBIOS name server IP address. If the NetBIOS name server is not functioning, computers will not be able to communicate.
• M-node (mixed): combines B-node and P-node, but functions as B-node by default. If M-node cannot resolve name using broadcast, then it uses the NetBIOS name server P-node.
• H-node (hybrid): combines P-node and B-node, but functions as P-node by default. If H-node cannot resolve a name with a NetBIOS name server, then a name broadcast is used.

Windows Server 2003 and Windows XP are configured as B-node types by default. When Windows XP, Windows Server 2003, or Windows 2000 is running on a computer and is configured to use WINS server addresses for name resolution, it automatically changes to H-node as H-node node type is for NetBIOS name registration. However, other operating systems may use other node types.

Users can use Dynamic Host Configuration Protocol (DHCP) options to assign the node type. To view a computer’s node type, type ipconfig/all at a command prompt.

How to determine whether a computer is running a 32-bit version or 64

Determine the operating system bit count

Locate the operating system that is running on your computer in this section, and then follow the steps to determine the bit count of your operating system. To have us help you determine your version, go to the "Fix it for me" section. If you’d rather determine the version yourself, go to the "Windows Vista or Windows 7" section, the "Windows XP" section or the the "Windows Server 2003" section.

Fix it for me

To fix this problem automatically, click the Fix this problem link. Then click Run in the File Download dialog box, and follow the steps in this wizard.

Note This wizard may be in English only. However, the automatic fix also works for other language versions of Windows.

Note If you are not on the computer that has the problem, you can save the automatic fix to a flash drive or to a CD so that you can run it on the computer that has the problem.

Windows Vista or Windows 7
If you have Windows Vista or Windows 7, there are two methods to determine whether you are running a 32-bit or a 64-bit version. If one does not work, try the other.

Method 1: View System window in Control Panel
Click Start  
 type system in the Start Search box, and then click system in the Programs list.
The operating system is displayed as follows:

For a 64-bit version operating system: 64-bit Operating System appears for the System typeunder System.

For a 32-bit version operating system: 32-bit Operating System appears for the System typeunder System.

Method 2: View System Information window

Click Start   , type system in the Start Search box, and then click System Information in thePrograms list.
When System Summary is selected in the navigation pane, the operating system is displayed as follows:
For a 64-bit version operating system: x64-based PC appears for the System type under Item.
For a 32-bit version operating system: x86-based PC appears for the System type under Item.
If you cannot determine the operating system bit count with these methods, go to the "Next Steps" section.

Windows XP
If you have Windows XP, there are two methods to determine whether you are running a 32-bit or a 64-bit version. If one does not work, try the other.
Method 1: View System Properties in Control Panel
Click Start, and then click Run. Type sysdm.cpl, and then click OK. Click the General tab. The operating system is displayed as follows:
For a 64-bit version operating system: Windows XP Professional x64 Edition Version < Year>appears under System.
For a 32-bit version operating system: Windows XP Professional Version  appears under System.
Note  is a placeholder for a year.

Method 2: View System Information window
Click Start, and then click Run.
Type winmsd.exe, and then click OK.
When System Summary is selected in the navigation pane, locate Processor under Item in the details pane. Note the value.
If the value that corresponds to Processor starts with x86, the computer is running a 32-bit version of Windows.
If the value that corresponds to Processor starts with ia64 or AMD64, the computer is running a 64-bit version of Windows.

If you cannot determine the operating system bit count with these methods, go to the "Next Steps" section.

Windows Server 2003

If you have Windows Server 2003, there are two methods to determine whether you are running a 32-bit or a 64-bit version. If one does not work, try the other.

Method 1: View System Properties in Control Panel
Click Start, and then click Run.
Type sysdm.cpl, and then click OK.
Click the General tab. The operating system is displayed as follows:
For a 64-bit version operating system: Windows Server 2003 Enterprise x64 Edition appears under System.
For a 32-bit version operating system: Windows Server 2003 Enterprise Edition appears under System.
Method 2: View System Information window
Click Start, and then click Run
Type winmsd.exe, and then click OK.
When System Summary is selected in the navigation pane, locate Processor under Item in the details pane. Note the value.
If the value that corresponds to Processor starts with x86, the computer is running a 32-bit version of Windows.
If the value that corresponds to Processor starts with EM64T or ia64, the computer is running a 64-bit version of Windows.
If you cannot determine the operating system bit count by using these methods, go to the "Next Steps" section.

Notes
To find the computer’s bit count, see the documentation that was included with the computer, or contact the hardware manufacturer.
Intel Itanium-based computers can run only 64-bit versions of Windows. Intel Itanium-based computers cannot run 32-bit versions of Windows. Currently, 64-bit versions of Windows run only on Itanium-based computers and on AMD64-based computers.