You can either configure your network settings in Windows 2000 through the
wizards that walk you through the initial installation of the OS, or you
can use the Control Panel to do it after Windows 2000 is up and running.
In order to best serve both approaches, the following directions will direct
a person through reconfiguring a functional Windows 2000 PC with appropriate
screen shots, but the sequence followed by this procedure mirrors that of
questions asked by the installation wizard. If you are installing the OS,
then simply answer the wizard's questions with information you can get from
the descriptions and screen shots below.
Please note: If you are installing Windows 2000 on a computer
and you intend to join that computer to a domain (your network
administrator will tell you if this is what you want to do), then one
of the last steps of the installation will require the intervention of
a person who is authorized to add you to the domain. They will need to
give their ID and password to the Installation Wizard in order to join you
to the domain. Do not start this process of installing Windows 2000
on a computer, expecting to join it to a domain without having access
to a person who can be present for this last step.
If you are installing Windows 2000 via the setup wizard, the first thing it
will ask you is the name of your computer. Our guideline for this is to use
your University Computing ID, then add something indicating your operating
system. Our examples tend to use "mst3k" as a substitute for your ID, so
please use your ID instead.
For those with functional Windows 2000 installations, you can specify this
by clicking on the Start button, then pointing to "Settings", then pointing
to the right and clicking on "Control Panel", yeilding something that looks
like this:
Double click the System icon highlighted in that screen shot, then
click on the Network Identification tab at the top of the resulting
dialog box as shown below:
If you don't see a Network Identification tab, then you are logged
in to Windows 2000 through an account that lacks Administrator priviledges.
If you can't log in as Administrator, you can't configure your network
settings. You need to either log in as Administrator or find the person who
can.
Now, for those with Administrator privaledges, click on the Properties
button (where the mouse is pointing in the dialog box shown above):
Your access to the network will be limited if your computer name
is not unique. Attempts at clever uniqueness will almost certainly match
someone else's clever attempt at uniqueness, so we highly suggest that you
start with your University Computing ID, then append a hyphen and a
description of your Operating System. As an example, "mst3k-win2k" would be
the computer used by the person whose University Computing ID is mst3k,
running Windows 2000. If you use more than one computer that would generate
the same ID using this system, add something unique after each computer name, like "2" or "3" and so forth.
Note for later that this is the same dialog box you use to establish
whether you are using peer to peer networking (Workgroups) or if you are
joining a domain.
Click on the "more" button as shown in the dialog box above and fill in
your department's subnet name. Examples are med.virginia.edu or
itc.virginia.edu or edschool.virginia.edu.
Windows 2000 participates in the Internet to such a degree that you cannot
be casual about security. Not only can others log into your computer through
the Internet, but they can use it in indirect attacks on other computers if
you do not sufficiently protect your computer from common attacks. If you
consider pressing Ctrl-Alt-Del and giving your ID and password each time you
start your computer to be too inconvenient for you, you probably should be
using Windows 98 instead of Windows 2000. There is always a balance to be
struck between security and convenience. Windows 98 is convenient. Windows
2000 is secure. If you try to make Windows 2000 convenient, you are almost
certainly opening up a dangerous hole in security both for yourself and for
others.
Maybe you don't lock your bicycle when you park it in your garage, but you
probably don't leave your keys in the ignition of your car. That is
somewhat of an analog for the difference between Windows 98 and Windows
2000.
If you are answering the installation wizard, next you
would set the password for your Administrator account. This is
important. For everyone else, let's begin back at the Control
Panel. Click Okay on all your current dialog boxes until
you are back at the Control Panel. Double Click Users and
Passwords.
In the resulting dialog box, make sure that there is a check box in the
option Users must enter a user name and password to use this computer.
Next, click on the Advanced tab at the top of this dialog box. Make
sure there is a check mark in the option Require users to press
Ctrl-Alt-Delete before logging on. Click on the Advanced button
where the mouse cursor is pointing in this example.
Select Users in the left column and Guest in the right column.
The Guest account is a default account with limited access to your computer
intended for public computers so that anyone who walks up to the computer
can use it. Again, since Windows 2000 is very network oriented, that also
means that people can log in as guest from anywhere in the world via the
Internet. For most people, you want to make sure the Guest account is
disabled. Right mouse click Guest.
Note the set password option in the menu. You can use this for all the
accounts you choose to set up for this computer. Make sure that there are
no accounts on your computer that do not have a secure password. That means
it has to be a password nobody can guess and you can't write it down
anywhere. If you write it down, someone will find it. You can write down
a clue if it would help you remember the password, but it would not help
anyone else guess it. As an example, I might have the password triW72
and I write right down the clue Al. The point here is that in high school,
I had a crush on Alicia Wirt. I never called her Al, but it is enough
of a clue to remind me of her and to spell her unusual last name backwards
and add the year I dated her. Nobody is going to see a post-it with the two
letters Al and guess triW72. And if that is not enough, roll
all these characters up by one to make usjX83.
There are many different approaches to making accounts on your computer.
Maybe you will only use Administrator. Maybe you will rename
Administrator or set up some other account and set limits on
your priviledges on the machine. The topic of security is too broad to
address comprehensively in this document. The basic things you want to
make sure you cover at the very least are:
- Disable the Guest account.
- Use secure passwords for all accounts.
- Don't write down the passwords or give clues that would lead anyone
to guess your password.
In the interest of disabling the Guest account, choose Properties from
the pop up menu you get when you right mouse click Guest.
Whatever else you do in this dialog box, make sure that you have a check
mark in the Account is disabled option box. For other accounts, do
be careful. If you lock yourself out of administrative priviledges, you could
lose access to your computer, once again proving that Windows 98 might have
been a better choice for your computer.
Click Okay in all your dialog boxes until you get back to the Control
Panel. If you are answering the Windows 2000 installation wizard, you now
must choose between Typical network settings or Custom settings. Choose
Custom. For those working with already-installed Windows 2000, go back to
the Control Panel.
Those installing Windows 2000 now need to choose networking protocols.
The rest of us can specify this through the following series of choices:
Home Directory Service and the ESERVICES server
both require Microsoft Networking and TCP/IP.
Meanwhile, we do not recommend that you turn on file or print
sharing, since turning these on means that you are offering to
share your hard drive and printer with other people, thereby
opening a vulnerability to hackers.
If you don't don't access Netware file or print servers,
you should not burden your computer with Client Service for
Netware. If you do access Netware servers, you
should turn on this driver and NWLink NetBIOS, NWLink
IPX/SPX/NetBIOS Compatible Transport Protocol. You can use
the Add button to acquire any of these dirvers if they
are missing from your list.
People installing Windows 2000 will next need to set certain
properties of TCP/IP. The rest of us do that by highlighting
the TCP/IP driver and then clicking properties.
This yields:
You want to confirm that you do Obtain IP address automatically
and Obtain DNS server address automatically. Now, click
Advanced in order to configure TCP/IP. Click on the
DNS tab at the top of the dialog box.
Choose Append these DNS suffixes (in order): and then click
on the Add button.
In the dialog box that appears, enter virginia.edu.
If you wish to use WINS (Windows Internet Naming Service),
click the WINS tab at the top of this dialog box. ITC has
WINS servers at these addresses:
Primary: 128.143.3.199
Secondary: 128.143.22.189
Otherwise, do not make any changes on this tab.
Some people will be using their PCs to join a domain, while others
will not. Essentially, this means that you either have a network
administrator who will have control over your PC and responsibility
for it or you don't. If you do, then you will log into a domain when
you start your computer and your computer will become a
member of a collection of computers working together under the direction
of the network administrator.
If you are to be part of a domain, your network administrator should
give you all the information you will need to specify in order to
set up your participation in the domain. You can use this to answer
the Windows 2000 installation wizard, or you can start at the
Control Panel and double click System to
set up your association with a domain. If you don't have someone
telling you what domain to join, do not try to join one. You won't
be able to.
If you are installing Windows 2000 with the Installation Wizard
and you are not joining a domain, just choose the option entitled
No, this computer is not on a network, or is on a network without
a domain. Type a workgroup name in the following box. You can
use the name WORKGROUP or any other name that is chosen by
people you would be sharing files with. You also want to choose the
option entitled Users must enter a user name and password to use
this computer. This will complete your installation of Windows 2000.
If you are joining a domain while installing Windows 2000, you should
choose the option labeled, Yes, make this computer a member of the
following domain: and then fill in the name of your domain. This is
the step you were warned about at the beginning of these instructions.
You will need your network administrator or someone else designated
with the power to add your computer to the domain now to provide their
ID and password in order for this step to work.
The rest of us with computers that already have Windows 2000 installed
can specify this by going to the Control Panel
and double-clicking System.
Click the Network Identification tab at the top of the resulting
dialog box, then click the Properties button.
Now, below the More... button, click in the option button for
Domain and fill in your domain name. This step will only work if
your network administrator has set up an account for your computer on
the domain. If this step does not work, contact your network administrator.
This should complete your configuration of Windows 2000 in order for it
to participate in networking at the University of Virginia.
Go to Windows 2000 support at UVa.
Go to support for other Windows
versions.
