Windows Server 2003 Recommended Baseline Security

Windows Server 2003
Recommended Baseline Security (ITSG-20)
achieved within a level; this allows you to create a matrix of policies for servers and
environments.
In a Workgroup environment, policy is applied in a prescribed order via policy files. This
provides a consistent security profile for servers in a Workgroup environment.
Since ‘policy files’ are simply text files, you can edit them with your favorite text editor. You
may also copy and paste the policy text found at the end of this document.
2.1.3 Monitoring and Enforcement
We have outlined a manual method that provides basic compliance verification. This manual
approach limits scalability of the solution. In a large environment, we recommend an automated
method.
2.2 Assumptions / Restrictions
2.2.1 Installation
For the installation of the OS, please ensure the following:
a. The CD-ROM is before the floppy drive in the boot device order;
b. There is no previous version of Windows (if not the installation will pause); and
c. The first available disk partition is for the operating system.
The following assumptions are made:
a. The Server to be installed is not a Cluster Member;
b. The Domain has an Organizational Unit for Servers;
c. The Domain has an Organizational Unit for Print Servers under Servers;
d. The Domain has an Organizational Unit for Files servers under Servers; and
e. The installation is limited to contents of the Microsoft Server 2003 distribution.
2.2.2 Policy
Application of the policy results in the following:
a. Local Guest account is renamed and disabled;
b. Local Administrator account is renamed and disabled;
c. All systems are Windows 2000 or later;
d. System will shutdown if unable to log security events;
e. No shares or named pipes can be accessed anonymously;
f. No registry data can be accessed remotely;
g. No accounts have the right to submit batch jobs;
h. Administrator accounts cannot start services (Use an appropriate SERVICE account);
i. Plug and Play is enabled when required as it is disabled by default; and
j. SNMP is disabled.
2.2.3 Policy Monitoring and Enforcement
No additional assumptions are required for Policy Monitoring and Enforcement.
6 March 2004 Overview