Windows Server 2003 Recommended Baseline Security

Windows Server 2003
Recommended Baseline Security (ITSG-20)
4.4.1.6 Audit policy change
AuditPolicyChange = 3
The ‘AuditPolicyChange’ defines the type of logon events that will be audited. The setting 3
audits ‘success and ‘fail’ events. ‘Success’ events are used in investigations to determine access
to the system and policy used at the time of the incident. ‘Fail’ attempts can determine if users
are probing the system for vulnerabilities.
4.4.1.7 Audit privilege use
AuditPrivilegeUse = 3
The ‘AuditPrivilegeUse’ defines logon events to be audited. The setting ‘3’ audits ‘success’ and
‘fail’ events. ‘Success’ events are used to determine who was accessing the system at the time of
the incident. ‘Fail’ attempts can determine if users are probing the system for vulnerabilities.
4.4.1.8 Audit process tracking
AuditProcessTracking = 0
The ‘AuditProcessTracking’ defines logon events to be audited. The setting ‘0’ audits no events.
The value of this information is weighed against the volume of data collected. Due to large
volumes of data, the normal setting for this value is disabled. However, during an incident the
information provided is invaluable. If an attack is suspected, we recommend the setting be
enabled.
4.4.1.9 Audit system events
AuditSystemEvents = 3
The’ AuditSystemEvents’ defines events to be audited. The setting ‘3’ audits ‘success’ and ‘fail’
events. These events reflect the system shutdown and restarts, system security events, and events
that affect the security log.
4.4.2 User Rights Assignments
4.4.2.1 Access this computer from the network
senetworklogonright = *S-1-5-11,*S-1-5-32-544
The ‘senetworklogonright’ grants network protocol access to the system (SMB, NetBIOS, CIFS,
HTTP and COM+). The policy grants privileges to the Administrators and authenticated users.
The ability to access the system from the network provides greater exposure for an attack.
Restricting access reduces the exposure.
Server Policy Files March 2004 49