Windows Server 2003 Recommended Baseline Security

Unclassified ITSG for Windows Server 2003
4.7.1.12 TCPMaxHalfOpenRetired
machine\system\currentcontrolset\services\tcpip\parameters\tcpmaxhalfopenretired=4, 80
The ‘tcpmaxhalfopenretired’ value determines how many connections the server can maintain in
the half-open state. The setting ‘80’ initiates SYN attack protection when the state table reaches
eighty connections.
4.7.1.13 NoNameReleaseOnDemand (TCP/IP)
machine\system\currentcontrolset\services\tcpip\parameters\nonamereleaseondemand=4, 1
The ‘nonamereleaseondemand’ registry determines if a system will release its NetBIOS name to
another computer on request. The setting ‘1’ prevents disclosure of NetBIOS information.
4.7.2 AFD.SYS Settings
4.7.2.1 DynamicBacklogGrowthDelta
machine\system\currentcontrolset\services\afd\parameters\dynamicbackloggrowthdelta=4, 10
The ‘dynamicbackloggrowthdelta’ value defines the number of free connections to create when
deemed necessary. The setting ‘10’ creates ten additional free connections. This setting ensures
additional resources are not applied too quickly, avoiding a potential DoS condition.
4.7.2.2 EnableDynamicBacklog
machine\system\currentcontrolset\services\afd\parameters\enabledynamicbacklog=4, 1
The ‘enabledynamicbacklog’ value enables dynamic backlog. The setting ‘1’ enables the
backlog. This ensures the system manages port resources in a manner that mitigates DoS attacks.
4.7.2.3 MinimumDynamicBacklog
machine\system\currentcontrolset\services\afd\parameters\minimumdynamicbacklog=4, 20
The ‘minimumdynamicbacklog’ value controls the minimum number of free ports on a listening
end point. The setting ‘20’ allows a system to create more if there is less than twenty available.
The setting is intended to ensure resources are available and limit the threat of DoS conditions.
4.7.2.4 MaximumDynamicBacklog
machine\system\currentcontrolset\services\afd\parameters\maximumdynamicbacklog=4,
20000
The ‘maximumdynamicbacklog’ value controls the number of ‘quasi-free’ connections allowed
on a listening end point. The setting ‘20,000’ is recommended to mitigate a DoS attack. The
setting reduces the resources allocated to incomplete connections. If creating additional free
ports exceeds the value, a system will not be able to maintain additional sessions.
100 March 2004 Server Policy Files