Windows Server 2003 Recommended Baseline Security

Unclassified ITSG for Windows Server 2003
4.4.2.2 Act as part of the operating system
setcbprivilege =
The ‘setcbprivilege’ grants an account the ability to act as part of the operating system.
According to Microsoft, there is no reason why an account would require this privilege.
4.4.2.3 Add workstations to domain
semachineaccountprivilege =
The ‘semachineaccountprivilege’ grants the right to add workstations to a domain. This policy
grants no privilege. Restricting this privilege helps maintain Domain integrity.
4.4.2.4 Adjust memory quotas for a process
seincreasequotaprivilege = *S-1-5-32-544,*S-1-5-19,*S-1-5-20
The ‘seincreasequotaprivilege’ grants the ability to adjust memory quotas for a process. This
policy grants privileges to Administrators, LOCAL SERVICE and NETWORK SERVICE
accounts. If misused, DoS attacks are possible.
4.4.2.5 Allow log on locally
seinteractivelogonright = *S-1-5-32-551,*S-1-5-32-544
The ‘seinteractivelogonright’ grants logon privilege to the local console. These privileges are
given to Administrators and Backup operators. Local access is restricted to accounts that have
legitimate reason for access. By restricting this privilege, system exposure is reduced.
4.4.2.6 Allow log on through Terminal Services
seremoteinteractivelogonright = *S-1-5-32-544
The ‘seremoteinteractivelogonright’ grants the right to logon remotely through Terminal
Services. This policy grants rights to Administrators. There is no requirement to allow users this
form of access.
4.4.2.7 Backup files and directories
sebackupprivilege = *S-1-5-32-551,*S-1-5-32-544
The ‘sebackupprivilege’ grants the right to backup files and directories. Rights are given to
Administrators and Backup Operators. If your policy does not allow administrators to backup
then omit the Administrators group. The allocation of this privilege must be tightly controlled.
50 March 2004 Server Policy Files