Windows Server 2003 Recommended Baseline Security

Windows Server 2003
Recommended Baseline Security (ITSG-20)
4.3.2.3 Reset account lockout counter after
ResetLockoutCount = 15
The ‘ResetLockoutCount’ defines the length of time (in minutes) before a lockout reset occurs.
The setting ‘15’ resets the lockout to zero after fifteen minutes. This value needs to be
synchronized with ‘LockoutDuration’ so the user can logon when the ‘LockoutDuration’ has
expired.
4.3.3 Kerberos Policy
There are no Kerberos settings in the Workgroup Baseline configuration.
4.3.3.1 Enforce user logon restrictions
TicketValidateClient = 1
The ‘TicketValidateClient’ determines if Kerberos V5 Key Distribution Centre authentication is
required. The setting ‘1’ requires the use of Kerberos Authentication.
4.3.3.2 Maximum lifetime for the service ticket
MaxServiceAge = 600
The ‘MaxServiceAge’ defines the number of minutes a service ticket will be valid. The setting
‘600’ allows the ticket to be used for ten hours.
4.3.3.3 Maximum lifetime for user ticket
MaxTicketAge = 10
The ‘MaxTicketAge’ defines the maximum hours a user’s ticket granting ticket may be used.
The setting ‘10’ indicates that the ticket granting ticket must be replaced or renewed after ten
hours.
4.3.3.4 Maximum lifetime for user ticket renewal
MaxRenewAge = 7
The ‘MaxRenewAge’ defines the number of days a ticket granting ticket may be renewed after
issuance. The setting ‘7’ allows a ticket granting ticket to be renewed for seven days.
4.3.3.5 Maximum tolerance for computer clock synchronization
MaxClockSkew = 5
The ‘MaxClockSkew’ defines the maximum amount of time a system clock can be different
from the Domain Controller clock. The setting of ‘5’ indicates systems more than 5 minutes
different than the Domain Controller clock will be refused.
Server Policy Files March 2004 47