Windows Server 2003 Recommended Baseline Security

Windows Server 2003
Recommended Baseline Security (ITSG-20)
4.4.2.8 Bypass traverse checking
sechangenotifyprivilege = *S-1-5-32-545,*S-1-5-32-551,*S-1-5-11,*S-1-5-32-544
The ‘sechangenotifyprivilege’ grants the right to bypass traverse checking in NTFS file systems
and the Registry. This policy grants rights to Users, Backup Operators, Administrators, and
authenticated users.
4.4.2.9 Change the system time
sesystemtimeprivilege = *S-1-5-32-544
The ‘sesystemtimeprivilege’ grants the right to change the system time. This policy grants rights
to Administrators. The system time is critical in incident investigation. Without a consistent time,
it is difficult to co-relate events on multiple systems.
4.4.2.10 Create a pagefile
secreatepagefileprivilege = *S-1-5-32-544
The ‘secreatepagefileprivilege’ grants the right to create a page file. This policy grants rights to
Administrators. Too large a page file can cause poor system performance. Restricting this to
Administrators reduces the exposure to trusted individuals.
4.4.2.11 Create a token object
secreatetokenprivilege =
The ‘secreatetokenprivilege’ grants the right to create local security token objects. The privilege
gives the ability to create or modify Access Tokens. This policy does not grant rights to anyone.
This can prevent privilege escalation attacks and DoS conditions.
4.4.2.12 Create global objects
secreateglobalprivilege = *S-1-5-6,*S-1-5-32-544
The ‘secreateglobalprivilege’ grants the right to create objects available to all sessions. This
policy grants rights to Administrators and the SERVICE account. It can be used to affect other
user’s processes.
4.4.2.13 Create permanent shared objects
secreatepermanentprivilege =
The ‘secreatepermanentprivilege’ grants the right to create shared objects (folders, printers).
Users with this privilege could expose sensitive data to the network by creating a shared object.
Only members of the Administrators group can create permanent shared objects.
Server Policy Files March 2004 51