Windows Server 2003 Recommended Baseline Security

Unclassified ITSG for Windows Server 2003
4.7.4.2 Always prompt client for password upon connection
Computer configuration\Administrative Templates\Windows Components\Terminal
Services\Encryption and Security \Always prompt client for password upon
connection\=Enabled
The “Always prompt client for password upon connection\=Enabled” setting forces the user to
logon to the local service. This policy enables password challenge upon connection.
4.7.4.3 Report Errors
Computer configuration\Administrative Templates\System\Error Reporting\=Disabled
The “Error Reporting\=Disabled” setting prevents the system from reporting error conditions to
Microsoft.
4.7.4.4 Remove POSIX Subsystem Registry Key
machine\system\currentcontrolset\control\session manager\subsystems\posix
The ‘posix’ value determines if the POSIX subsystem is supported. This policy deletes the key.
This prevents inadvertent use of the subsystem.
4.7.4.5 Set BIOS Password
The system BIOS should be password protected. This follows vendor specific procedures that are
not outlined in this document.
4.7.4.6 Disable Memory Dump
Control Panel/System Properties/Advanced/Startup and Recovery-SettingsWrite Debugging
Information=None
The ability to dump memory in case of a program failure should be disabled. The likelihood of
requiring a memory dump is low, however, if needed you may temporarily enable it.
4.7.4.7 Boot Immediately to Windows
My Computer/Properties/Advanced/Startup and Recovery-Settings/Time to display list of
operating systems=0
The ‘Time to display list of operating systems’ value determines the number of seconds the
system displays Operating System options at boot time. The setting ‘0’ prevents alternate boot
during normal operations.
4.7.4.8 Disassociate .reg Files from the Registry Editor
1. Start/Settings/Control Panel/Folder Options
2. Select ‘REG’extension
104 March 2004 Server Policy Files