Windows Server 2008 R2 regular server maintenance

Basics

1: System Health Check

1.1: Event Log Check (Application/Security/System)

: Daily Check

: Found a log with errors needs to check the cause and troubleshoot

1.2: Shared folder check

: Daily check

: Found no Allowed shared folders, delete now

1.3: Local user and group check

: Daily check

: Unauthorized users and groups are found, delete immediately

1.4: Disk Size and Fragmentation Check

: Daily Check

: Found disk space below alert (30% available), need to clean up useless disk files < Br>

: Found disk fragmentation greater than alert value (70% fragmentation), need to defragment during server idle time

1.5: System service and application check

: Daily check

: Unauthorized installation of system services and applications, immediately removed

1.6: IIS check

: Daily check

: Found Unauthorized web site running, delete now

1.7: Process and application check

:Check multiple times a day

:Discover suspicious processes and applications , close immediately and find the running file to delete

1.8: Check cpu usage and memory usage

: Daily check multiple times

: Found cpu occupied for a long time High (90%) check the main reason, see the situation to restart the server

2: Database status check maintenance

2.1: Check the running results of the daily maintenance of the database

: Daily Check

: Ensure that data and logs are properly backed up as required, re-manual backups that fail to run and eliminate the cause of the error

2:2: Check the transaction log of the database

:Each Daily check

: When the transaction log is larger than 300M, the log needs to be shrunk after the full backup log.

2.3: Check the fragmentation of the database file

:Check every half month< Br>

: When the fragmentation of the database is greater than the alert value, you need to defragment work

:Method 1

If the scan density and average page density are less than 100% indicating that debris is generated, the two should be kept at a high percentage. Logical and sector scan fragments should be as close as possible to zero, and should generally not exceed 10.

3: web system check

3.1: web system login check

: daily check

: ensure that the web system can log in normally

3.2: Response check for web system

: Daily check

: Check the request and response speed of the web system. If the response is too slow or unresponsive, you need to check the cause and exclusion.

3.3: File Checking for Web Systems

: Monthly Checking

: Checking and Backing Up Web Program Files

4: Web Traffic Check < Br>

4.1: web traffic check

: daily check

: Ensure that the traffic is normal and the traffic is abnormal. You need to find out the cause and solve it.

Special Items

1.“Computer Configuration”/“Windows Settings”/“Security Settings”/“Software Restriction Policies”Options, with the right mouse button Click this option and execute the "Create Software Restriction Policy" command in the shortcut menu; double-click the "Force" group policy item with the mouse to open the settings dialog shown in Figure 1, and select "Except" All users except the local administrator ” option, the rest of the parameters remain the default settings, and then click the "OK" button to end the above settings

2. Deny network viruses hidden in temporary files

Group Policy Editing Commands>gpedit.msc”Select “Computer Configuration”/“Windows Settings”/“Security Settings”/“Software Restriction Policies”/“Other Rules” At the same time, right-click the option and execute the "New Path Rule" command in the shortcut menu to open the settings dialog shown in Figure 2; click on the "Browse" button From the file selection dialog box that pops up, select and import the temporary folder of the Windows Server 2008 system, and then set the "Security Level" parameter to "Don't allow", and finally click "Determine" " >

3. Prevent illegal PING

string command“gpedit.msc”“computer configuration”node option, and select one by one from the target node<quo;Windows Settings”,“ Security Settings & rdquo;, "Advanced Security Windows Firewall", "Advanced Security Windows Firewall——Local Group Policy Object" option, and then use the mouse to select the "Inbound Rules" item under the target option; In the “Actions” list on the right side of the corresponding “Inbound Rules” item, click the “New Rule” option. At this time, the system will automatically pop up the New Inbound Rules Wizard dialog box, according to the wizard screen. Prompt, first select the “Customize” option, then select the "All Programs" item, and then select “IC from the Protocol Type list. MPv4”.

After the wizard screen prompts us to choose what type of connection condition, we can select the "Block connection" option,

4. Disconnect the remote connection to restore the system state [Special case Processing]

Enter the “gpedit.msc” command, second select the “User Configuration” node branch at the left side of the Group Policy Console window, and use the mouse to select the target node branch below one by one. Manage Templates & rdquo; /& ldquo; Network & rdquo; /& ldquo; Network Connections > Group Policy Options, then double-click the "Network Connections" branch below the "Delete all users remote access connection" option, in the pop-up Figure 5 In the option settings dialog box shown, select the “Enabled” option, and then click “OK"Save button

5. Force all connections to be connected

Enter in the Run box The string command “gpedit.msc”, enters the group policy editing interface of the local server system;

Secondly, the mouse is positioned in the "computer configuration" //ldquo; administrative template ”/“network”/“network connection"/“Windows Firewall”/“standard profile” branch option, under the "standard profile" branch option, double click with the mouse“ Windows Firewall: Protect all network connections > Group Policy option, open the target group policy attribute interface as shown in Figure 4; select the “ Enabled & rdquo; project in the interface, and finally click & ldquo; OK & rdquo; button

Part 2

1. Turn off the default share

2. Change the password for a maximum period of 90 days

3. Account lockout threshold 5 times failure 10 Can try again in minutes

4. Audit Policy

Audit Policy Change Successfully Failed

Audit Login Event Successfully Failed

Audit System Event Success Failed
>

Try changing system time