'The most secure Windows ever' may be very secure from hackers and malware - but what do you do when Longhorn Server let's you install the OS, set up Active Directory, and initialize the domain without once asking you to even create an administrator password? "What happened to Windows Server? Where did all of the stringent security checks and ultra-protection of Windows Server 2003 go? Windows Server 2000 was quite insecure, and Windows Server 2003 turned over a new leaf... But it seems Microsoft is more than willing to flip that page back - even Windows Server 2000 required an Administrator password at the very least."
Post a Comment
Member since:
2006-01-10
Member since:
2006-07-16
Member since:2005-11-15
Member since:
2005-10-02
Member since:
2005-07-06
i don't see why setting an admin password is important for installations that will last for a week, installations that will never be used in a production enviromnent.
come on, longhorn server is still in development, the programmers have better things to do than to remember passwords. enabling passwords and complexity rules is trivial as soon as longhorn server leaves the alpha stage and becomes beta.
Member since:2006-07-13
ok, so 'in development' means that you can skip the security ? Interesting thought. If programmers already have trouble in remembering passwords and enabling them, how would the rest of the product be ?
I even know alpha quality code that works better and is more safe than production code of MS.
Security is something that should be written from ground up, not as an aftermarket item that may be purchased separately.
Member since:2006-05-01
The sad thing is, Microsoft claimed they 'learned' from their mistake with XP.
In XP, security was an afterthought (not just with MS - in 2001 no one gave a damn about security really).
They <em>did</em> do right with Vista... But I mean, you would expect the server OS to be even <em>more</em> secure, wouldn't you?
Yet, it isn't... Sad.
Member since:2005-08-09
Member since:2005-07-06
Member since:2006-05-01
Member since:2005-07-06
Member since:2006-05-01
Member since:2005-07-06
True, but the issue is more to do with the Microsoft culture rather than NT itself; NT has the potential to be the most secure operating system out there, had they stuck to the original NT design, but they chose to compromise for the sake of convienence, ease of use and compatibility - its all coming back to bite them in the ass.
Personally, if they did do the above, it would be the *perfect* opportunity to offer customers *deep* discounts on upgrades and competitive upgrades for Microsofts middleware.
Member since:2005-07-06
There is still a deployment process and part of that deployment process could be switching a flag to enables asking for an admin password during install.
There is simply no reason whatsoever to do that. You don't just turn these things on. They need to enabled right throughout the development process so people can actually see that it works.
Member since:2005-07-06
Member since:2005-07-06
Member since:2005-12-28
What if you are testing the installation for security and where it is at with it??? I would think that security would play a role in any evaluation of a server product...
If its not there now I would feel little off knowing that it can be added at a whim... To me that says that it can be removed as easily.
Member since:
2006-06-01
Member since:2006-09-14
Member since:2006-05-01
Who said anything about local?
That's what makes it so disasterous: the DOMAIN admin account, the one that has complete control over everywhere and all over the domain - over every single PC joined to the domain, over the AD, over the DNS, over the DHCP and the ISA server and Exchange.
That one password controls everything that's why it's THIS serious and that big of a deal..
Thank god for organizations like NST that point these things out - I think if no one said anything LH would ship with "admin" as the default password and no way to change it.
Member since:2005-07-06
RE[3]: In a domain model
Member since:2005-12-02
Member since:2005-07-06
Member since:2006-05-01
Member since:2006-03-10
Anyway, I don't care about Windows at all. Not using it at all.. Only as gaming console with all services, funky colors turned off 
I always find it amusing when I see posters claim they don't care about Microsoft, yet they open threads about Microsoft products, and post comments.
Member since:
2006-01-02
I think LH server is meant to be configured into a particular role, which sets all of its security policy and installed software. Perhaps the role hasn't been configured yet in the dev build, so password reqs are off. Trust me, MSFT hires a lot of penetration testers and this would be caught right away if it were a problem.
Member since:
2006-05-24
"Security is something that should be written from ground up, not as an aftermarket item that may be purchased separately."
As an unfortunate Windows administrator, I have to live this failure every day. Their notion of security is basically a slap in the face to the "worker" side of computer systems. Absolutely pathetic.
Windows 2003 was an improvement, but that doesn't matter, since there are literally millions of improperly-set-up Windows 2000 servers out there, running in production where changes are very dangerous to various companys' businesses.
You're also right that there's absolutely *no good reason* to let developers off the hook in this regard. Most of what runs on Microsoft platforms is applications, and my experience is that application developers couldn't care less about security unless they're forced to.
That is what Microsoft should have done in the first place, right from the start - forced application developers to operate in a secure environment.
Why, for example, did it take them until 2004 to develop an OS that formats hard drives with proper (or reasonably proper) permissions by default?
Member since:2006-05-01
Member since:
2006-03-20
Member since:
2006-10-11
