Windows Server 2003 Recommended Baseline Security

Unclassified ITSG for Windows Server 2003
4.7.3.6 Enable Safe DLL search mode (recommended)
machine\system\currentcontrolset\control\session manager\safedllsearchmode=4, 1
The ‘safedllsearchmode’ value determines the order DLLs are searched. The setting ‘1’
commands the system to first look in the PATH, then the current folder. This order ensures files
in the current foder do not run in place of files in the users PATH.
4.7.3.7 Disable Autorun on CD-ROM
machine\system\currentcontrolset\control\services\CDRom\AutoRun=4, 1
The ‘Disable Autorun on CD-Rom’ prevents automatic execution of programs upon insertion of
a CD. The setting ‘1’disables the Autorun feature. This helps reduce the threat of malicious code
infection through CD-Rom.
4.7.3.8 Disable Administrative Shares
machine\system\currentcontrolset\control\services\LanmanServer\Parameters\AutoShareServ
er=4, 0
The ‘AutoShareServer’ value determines if disk drives have administrative shares. The setting
‘0’ disables administrative shares.
4.7.3.9 Disable DCOM
machine\Software\Microsoft\OLE\EnableDCOM=4, 0
The ‘EnableDCOM’ value determines if DCOM is active. The setting ‘0’disables DCOM.
4.7.4 Manual Activities
The following elements could not be automated. They must be manually configured.
NOTE:
For 4.7.4.1 through 4.7.4.3, use the following procedure to reach the “Computer
Configuration” level in either MMC (for Workgroup server) or Active Directory (for
domain server).
For a Domain server do the following:
1. Invoke “Active Directory”.
2. Right click “Public Server” OU and select “Properties”.
3. Select the “Group Policy” tab.
4. Select “CSE High Security – Baseline Policy”.
5. Click “Edit”.
The Computer Configuration entry is now displayed on the screen.
102 March 2004 Server Policy Files