Although you are probably on-target in wanting to work on Windows security, let me begin my reply by noting that Microsoft recommends the CompTIA Security+ certification for MCSAs and MCSEs seeking to specialize in security, whether their focus is Windows 2000 or Windows Server 2003. With that in mind, I'd urge you to obtain a good study guide and the Exam Cram for Security+, and tackle that topic first before going after Windows security in general.
Once you've used the Security+ to make sure you've got a good, solid grasp of basic security principles, practices and policies, then you can go after Windows security in one of two ways:
1. You could pursue the security specialization for MCSA or MCSE, either on Windows 2000 or Windows Server 2003. (But frankly, given that Windows Server 2003 isn't likely to rule the market for another 12-18 months, it probably makes more sense to go after Windows 2000 now and worry about how to upgrade your certifications later on.)
2. You can pick and choose among MCP exams that relate to security without regard to certification: 70-214 or 70-299 are good initial choices with 70-227, 70-220 or 70-298, worthy of additional consideration later on. Even if you don't decide to take these exams you can still use related study guides, exam crams, and so forth to make sure you understand and master the material involved.
For more info on this topic, please visit these SearchSecurity.com resources:
This was first published in October 2003