Windows Server 2003 Recommended Baseline Security

Windows Server 2003
Recommended Baseline Security (ITSG-20)
4.7.3 Other Security Related Settings
4.7.3.1 NoNameReleaseOnDemand (NetBIOS)
machine\system\currentcontrolset\services\netbt\parameters\nonamereleaseondemand=4, 1
The ‘nonamereleaseondemand’ value determines if a system releases its NetBIOS name upon a
name-release request. The setting ‘1’ prevents a system from releasing the NetBIOS name, other
than to WINS servers. This reduces information it provides to an unauthorized user.
4.7.3.2 Enable the computer to stop generating 8.3 style filenames
machine\system\currentcontrolset\control\filesystem\ntfsdisable8dot3namecreation=4, 1
The ‘ntfsdisable8dot3namecreation’ value determines if a system will generate 8.3 file names.
The setting ‘1’ prevents the 8.3 filename format. Generation of 8.3 file makes the task of name
guessing easier for an attacker. Disabling this ensures only the full name is used to reference
files.
4.7.3.3 NoDriveTypeAutoRun
machine\software\microsoft\windows\currentversion\policies\explorer\nodrivetypeautorun=4,2
55
The ‘nodrivetypeautorun’ value determines if autorun is enabled on connected drives. The
setting ‘255’ disables autorun for all drives on the system. This ensures privileged users do not
run unapproved software. Without restrictions, unapproved software may run inadvertently.
4.7.3.4 The time in seconds before the screen saver grace period expires (0
recommended)
machine\system\software\microsoft\windowsnt\currentversion\winlogon\screensavergraceperi
od=4, 0
The ‘screensavergraceperiod’ value determines the amount of time (in seconds) to enforce the
screen saver password. The setting ‘0’ enforces password lock with no time delay. This provides
an immediate lock when the idle threshold is reached.
4.7.3.5 Warning Level
machine\system\currentcontrolset\services\eventlog\security\warninglevel=4, 90
The ‘warninglevel’ value determines the maximum amount of security logs before a warning
event is triggered. The setting ‘90’ triggers a warning when the Security log reaches 90%
capacity. This will afford sufficient time to reset the log and determine reasons for the warning.
Server Policy Files March 2004 101