Windows Server 2003 Recommended Baseline Security

Windows Server 2003
Recommended Baseline Security (ITSG-20)
4.2 Baseline Server Policy Files Details ........................................................ 45
4.3 Account Policies ...................................................................................... 45
4.3.1 Password Policy............................................................................ 45
4.3.2 Account Lockout Policy ................................................................. 46
4.3.3 Kerberos Policy ............................................................................. 47
4.4 Local Policies........................................................................................... 48
4.4.1 Audit Policy ................................................................................... 48
4.4.2 User Rights Assignments.............................................................. 49
4.4.3 Security Options............................................................................ 56
4.5 Event Log................................................................................................. 69
4.5.1 Log Size ........................................................................................ 69
4.5.2 Guest Access................................................................................ 70
4.5.3 Retention Method.......................................................................... 70
4.6 System Services ...................................................................................... 70
4.6.1 Services Explicitly Covered by Microsoft Guidance ...................... 71
4.6.2 Services Not Explicitly Covered by Microsoft Guidance................ 97
4.7 Additional Security Settings ..................................................................... 98
4.7.1 Security Consideration for Network Attacks .................................. 98
4.7.2 AFD.SYS Settings....................................................................... 100
4.7.3 Other Security Related Settings.................................................. 101
4.7.4 Manual Activities ......................................................................... 102
4.7.5 Access Controls .......................................................................... 105
4.7.6 Variance from Microsoft Guidance.............................................. 111
5 Role Based Server Policies ........................................................................... 117
5.1 Role Based IPSec Policies .................................................................... 117
5.1.1 Load IPSec policy ....................................................................... 117
5.1.2 Activate IPSec Policy .................................................................. 117
5.2 Domain File Server Security Policy........................................................ 118
5.2.1 Variance from Microsoft “Hardening File Servers” Guidance ...... 118
5.2.2 [Service General Setting] ............................................................ 119
5.2.3 Domain File Server IPSec Policy ................................................ 119
5.3 Domain Print Server Policy .................................................................... 121
5.3.1 Variance from Microsoft “Hardening Print Servers” Guidance .... 121
5.3.2 [Registry Values] ......................................................................... 121
5.3.3 [Service General Setting] ............................................................ 122
5.3.4 Domain Print Server IPSec Policy............................................... 122
5.4 Workgroup File Server Policy ................................................................ 124
5.4.1 Variance from Microsoft Guidance.............................................. 124
5.4.2 [Registry Values] ......................................................................... 124
5.4.3 [Service General Setting] ............................................................ 124
5.4.4 Workgroup File Server IPSec Policy ........................................... 125
5.5 Workgroup Print Server Policy............................................................... 126
5.5.1 Variance from Microsoft Guidance.............................................. 126
5.5.2 [Registry Values] ......................................................................... 127
5.5.3 [Service General Setting] ............................................................ 127
5.5.4 Workgroup Print Server IPSec Policy.......................................... 127
x March 2004 Table of Contents