Windows Server 2003 Recommended Baseline Security

Unclassified ITSG for Windows Server 2003
• Select the “General” tab.
• Click on the “Settings” button.
o “Key Exchange Settings” dialog displayed.
• Click the “Methods” button.
o The “Key Exchange Methods” dialog displayed.
• Remove all settings except the following (ensure they are in the order below):
IKE 3DES SHA1 High (1024)
IKE 3DES SHA1 Med (2)
• Click “OK”.
• Click “OK”.
• Click “File”.
• Click “Exit”.
o “Microsoft Management Console” dialog displayed
• Select “Yes” if you wish to save the settings (otherwise select “No”).
5.2 Domain File Server Security Policy
The domain-based file server allows authenticated users to access shared files in the domain.
These shared files can use file protection to control access. Access attempts from outside a
domain can authenticate with domain-based credentials. Once authenticated, access is granted
based on domain policy.
To fulfill file services, the Baseline configuration settings do not require further changes.
5.2.1 Variance from Microsoft “Hardening File Servers” Guidance
In the Microsoft hardening policy for Domain file servers, Distributed Files system and File
Replication services are disabled. In the CSE Baseline configuration these same services are
disabled; therefore they need not be disabled in the File Server policy.
The remaining differences are a result of CSE and Microsoft Baseline configuration variance.
It is important to note that the role-based policies cannot be viewed in isolation from the Baseline
configuration.
118 March 2004 Role Based Server Policies