Windows Server 2003 Recommended Baseline Security

Windows Server 2003
Recommended Baseline Security (ITSG-20)
1 Introduction
1.1 Background
Threat agents exploit vulnerabilities to either gain control or disable a computer. Experts differ
on what may be the primary cause of computer vulnerabilities. Some will agree that two causes
are exploitation of defects in software, and lack of secure configurations.
To address software defects, vendors issue patches in many forms. These are designed to
address software defects particular to an operating system or application. Although they fix one
problem, patches create other issues. In addition to patches, checklists are used to provide
computer users with secure and tested configuration guides.
In the past, Government agencies 1 have produced and disseminated checklists for securing
computer systems. However, the way checklists are produced has changed. Vendors realize
benefits producing configuration checklists for their own products. In turn, public and private
organizations save time and money by leveraging this complex work.
1.2 Aim
ITSG-20 provides a practical set of security settings for Microsoft Windows Server 2003. The
aim is to establish and maintain a High Security Windows Server 2003 environment.
There are two platform variants: Domain Server and Workgroup Server. We cover two
applications as well: Print Server and File Server. In other words, we provide four
configurations, one for each application running on each platform, as follows:
1) Domain File Server
2) Domain Print Server
3) Workgroup File Server
4) Workgroup Print Server
The guideline provides a Baseline configuration that applies to all servers of a given type,
Domain Server or Workgroup Server. Given that the Baseline configuration provides security
before functionality, it should be used as a starting point. File and Print Server application
policies are layered on top of the Baseline configuration. In this way, we provide a template for
creating additional server roles based on the CSE Baseline. Application policies layered above
the Baseline enables the server to function as intended.
1.3 Scope
ITSG-20 provides guidance to build High Security Domain and High Security Workgroup
servers. Additional policies can be applied to support a variety of roles within your organization.
1 Agencies such as: National Institute of Standards and Technology (NIST), National Security Agency (NSA),
Center for Internet Security (CIS), and SANS (SysAdmin, Audit, Network, Security).
Introduction March 2004 1