There's a lot of stuff in there like PKI and authentication etc. From my experience of implementation, i've always used the default 2003 security out of the box with only a few minor tweaks here and there, and i've never had any security breaches providing i've used a good hardware Firewall and a good central protection suite such as McAfee Total Protection or Kaspersky. Maybe for government releated domains or extremely confidential stuff, you might tweak a few settings here and there but since SP2 for 2k3 Server and 2k8, I think this is more than adequate for the majority of businesses. I just always make sure users meet my complexity requirements for passwords with lowercase and numbers in their passwords, and this has always been fine for me.
I can't wait for my next exam (as much as you CAN look forward to revising
) as it's Exchange and Active Directory which I enjoy. Thoughts on this?
