Windows Server 2003 Recommended Baseline Security

Windows Server 2003
Recommended Baseline Security (ITSG-20)
5 Role Based Server Policies
The following policy files apply settings specific to the role they serve. They do not contain
every setting required for a server; therefore apply these settings after the Baseline configuration.
5.1 Role Based IPSec Policies
Role based IP Security Policy is applied in a two-step process. The first step is to load the policy
into the policy editor. The second step is to activate the policy. This is achieved with the Group
Policy Editor.
5.1.1 Load IPSec policy
• Activate “Windows Explorer”.
• Browse to location of desired IPSec policy file (must have .CMD extension).
• Right click on policy command files and select “Open”.
o Command window will open, execute the policy command file, and close.
5.1.2 Activate IPSec Policy
• Open a command window.
• Enter “MMC” and press “Enter”.
o “Console 1” dialog opens.
• Click “File”.
• Select “Add/Remove Snap-in”.
o “Add/Remove Snap-in” dialog displayed.
• Click “Add”.
o “Add Standalone Snap-in” dialog displayed.
• Browse to and select “IP Security Policy Management”.
• Click “Add”.
o “Select Computer or Domain” dialog displayed.
• Accept defaults and click “”Finish”.
• Click “Close”.
• Click “OK”.
• In the “Root Console Window”, click on “IP Security Policies on Local Computer”.
• In right frame right click the desired IP Security policy and select “Assign”.
• Right click the active policy and select “Properties”.
Role Based Server Policies March 2004 117