Windows Server 2003 Recommended Baseline Security

More documents

Recommendations

Info

Unclassified ITSG for Windows Server 2003 5.3.3 [Service General Setting] "lanmanserver", 2, "D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCR SDRCWDWO;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" "browser", 2, "D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCR SDRCWDWO;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" "spooler", 2, "D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCR SDRCWDWO;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" 5.3.4 Domain Print Server IPSec Policy The following file is supplied as part of the Microsoft Windows Server 2003 Security Guideline. The file must be modified to reflect domain controller addresses. Once modified the procedure outlined in 5.1 Role Based IPSec Policies is used to apply the policy. REM (c) Microsoft Corporation 1997-2003 REM Packet Filters for Server Hardening REM REM Name: PacketFilter-File.CMD REM Version: 1.0 REM This CMD file provides the proper NETSH syntax for creating an IPSec Policy REM that blocks all network traffic to a File Server except for what is REM explicitly allowed as described in the Windows 2003 Server Solution Guide. REM Please read the entire guide before using this CMD file. REM Revision History REM 0000 - Original February 05, 2003 REM 0000 - Original April 03, 2003 :IPSec Policy Definition netsh ipsec static add policy name="Packet Filters - File" description="Server Hardening Policy" assign=no :IPSec Filter List Definitions netsh ipsec static add filterlist name="CIFS/SMB Server" description="Server Hardening" netsh ipsec static add filterlist name="NetBIOS Server" description="Server Hardening" 122 March 2004 Role Based Server Policies
Windows Server 2003 Recommended Baseline Security (ITSG-20) netsh ipsec static add filterlist name="Terminal Server" description="Server Hardening" netsh ipsec static add filterlist name="Domain Member" description="Server Hardening" netsh ipsec static add filterlist name="Monitoring" description="Server Hardening" netsh ipsec static add filterlist name="Block Domain Access" description="Server Hardening" netsh ipsec static add filterlist name="ALL Inbound Traffic" description="Server Hardening" :IPSec Filter Action Definitions netsh ipsec static add filteraction name=SecPermit description="Allows Traffic to Pass" action=permit netsh ipsec static add filteraction name=Block description="Blocks Traffic" action=block :IPSec Filter Definitions netsh ipsec static add filter filterlist="CIFS/SMB Server" srcaddr=any dstaddr=me description="CIFS/SMB Server Traffic" protocol=TCP srcport=0 dstport=445 netsh ipsec static add filter filterlist="CIFS/SMB Server" srcaddr=any dstaddr=me description="CIFS/SMB Server Traffic" protocol=UDP srcport=0 dstport=445 netsh ipsec static add filter filterlist="NetBIOS Server" srcaddr=any dstaddr=me description="NetBIOS Server Traffic" protocol=TCP srcport=0 dstport=137 netsh ipsec static add filter filterlist="NetBIOS Server" srcaddr=any dstaddr=me description="NetBIOS Server Traffic" protocol=UDP srcport=0 dstport=137 netsh ipsec static add filter filterlist="NetBIOS Server" srcaddr=any dstaddr=me description="NetBIOS Server Traffic" protocol=UDP srcport=0 dstport=138 netsh ipsec static add filter filterlist="NetBIOS Server" srcaddr=any dstaddr=me description="NetBIOS Server Traffic" protocol=TCP srcport=0 dstport=139 netsh ipsec static add filter filterlist="Terminal Server" srcaddr=any dstaddr=me description="Terminal Server Traffic" protocol=TCP srcport=0 dstport=3389 netsh ipsec static add filter filterlist="Block Domain Access" srcaddr=me dstaddr=any description="Block Domain Access" protocol=TCP srcport=any dstport=1097 netsh ipsec static add filter filterlist="ALL Inbound Traffic" srcaddr=any dstaddr=me description="ALL Inbound Traffic" protocol=any srcport=0 dstport=0 REM NOTE: IP Address or server names of Domain Controllers must be hard coded into the dstaddr of the Domain Member filters defined below netsh ipsec static add filter filterlist="Domain Member" srcaddr=me dstaddr=192.168.0.1 description="Traffic to Domain Controller" protocol=any srcport=0 dstport=0 REM netsh ipsec static add filter filterlist="Domain Member" srcaddr=me dstaddr= description="Traffic to Domain Controller" protocol=any srcport=0 dstport=0 REM NOTE: IP Address or server name of Monitoring server must be hard coded into the dstaddr of Monitoring filter defined below Role Based Server Policies March 2004 123
Page 1 and 2:
IT Security Guidance Windows Server
Page 3 and 4:
Windows Server 2003 Recommended Bas
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Page 15:
Page 18 and 19:
Page 20 and 21:
Page 22 and 23:
Page 24 and 25:
Page 26 and 27:
Page 28 and 29:
Unclassified ITSG for Windows Serve
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
Page 66 and 67:
Page 68 and 69:
Page 70 and 71:
Page 72 and 73:
Page 74 and 75:
Page 76 and 77:
Page 78 and 79:
Page 80 and 81:
Page 82 and 83:
Page 84 and 85:
Page 86 and 87:
Page 88 and 89:
Page 90 and 91:
Page 92 and 93: Unclassified ITSG for Windows Serve
Page 192 and 193:
Page 194 and 195:
Page 196 and 197:
Page 198 and 199:
Page 200 and 201:
Page 202 and 203:
show all

Windows Server 2003 Recommended Baseline Security

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?