Win2k domain controllers and firewall

My thoughts are this.
Do not make the server outside of the secure network a BDC. What this will do is allow the chance for somebody to hack into you SAM accounts and compromise your system. Make it just a member server.
For the firewall you can do so many things. One is to put access lists that allows the ip address (and I am assuming that you are using private addresses for the inside) of the computers inside your network and only those ip addresses to pass through the firewall. To have the server talk back with the secure network allow the ip address only of the web/email server with only these ports
..25 for mail, 80 for web, 137-139 for netbios names,445 for microsoft ds...remember only allow those ports from that ip address in.

The whole point of a DMZ is to isolate outside servers from the production domain so I'm not sure why you wouldn't just move the W2K server onto the secure network as opposed to leaving it in the DMZ and punching all kinds of holes in the firewall.
If you moved the W2K server into the secure domain, you would only have to enable ports 25 (SMTP) and 80 (HTTP) and only to that IP from the outside world. Make the W2K a member server as already suggested, and just keep up with the steady streamof IIS patches.

In my opinion, the NetBIOS ports are the most hacker-prone of all so opening those ports from the DMZ to your secure domain doesn't make sense to me, access-lists notwithstanding.

paul

Do you recommend then that I enroll users into the web/mail server separately in order to allow my users to log into secure web sites? By doing this I will create a lot more administration and cause some inconvenience on the user by requiring them to manage two separate accounts with two separate passwords. They are already frustrated with the number of user accounts they have across our internal systems that have passwords that expire at different times.

I'll do it if it is really the best way to do it, but I just want to be sure before proceeding since it will require quite a bit of setup.

Thanks

No, I mean make it a member server, which will allow all users to access the server with one account. And with the NetBios ports, you only allow netbios ports from the server in the DMZ, doing this will not allow any hacker to enter the site.
allow those ports though and you have your secure site and your DMZ.

You must understand that there are no PDC's and BDC's in a Win2k environment. All DCs are equal. In mixed mode there is a FSMO called the PDC Emulator which does just that. If both of your servers are part of the same forest there should not be a problem.

This question was closed by the author