Windows Server 2003 Recommended Baseline Security

Windows Server 2003
Recommended Baseline Security (ITSG-20)
5.4.4 Workgroup File Server IPSec Policy
The following file has been modified from the one supplied as part of the Microsoft Windows
Server 2003 Security Guideline. The procedure outlined in 5.1 Role Based IPSec Policies is used
to apply the policy.
REM (c) Microsoft Corporation 1997-2003
REM Packet Filters for Server Hardening
REM
REM Name: PacketFilter-File.CMD
REM Version: 1.0
REM This CMD file provides the proper NETSH syntax for creating an IPSec Policy
REM that blocks all network traffic to a File Server except for what is
REM explicitly allowed as described in the Windows 2003 Server Solution Guide.
REM Please read the entire guide before using this CMD file.
REM Revision History
REM 0000 - Original February 05, 2003
REM 0000 - Original April 03, 2003
:IPSec Policy Definition
netsh ipsec static add policy name="Packet Filters - File" description="Server
Hardening Policy" assign=no
:IPSec Filter List Definitions
netsh ipsec static add filterlist name="CIFS/SMB Server" description="Server
Hardening"
netsh ipsec static add filterlist name="NetBIOS Server" description="Server Hardening"
netsh ipsec static add filterlist name="Terminal Server" description="Server
Hardening"
netsh ipsec static add filterlist name="ALL Inbound Traffic" description="Server
Hardening"
:IPSec Filter Action Definitions
netsh ipsec static add filteraction name=SecPermit description="Allows Traffic to
Pass" action=permit
Role Based Server Policies March 2004 125