Windows Server 2003 Recommended Baseline Security

Unclassified ITSG for Windows Server 2003
4.4.2.14 Debug programs
sedebugprivilege =
The ‘sedebugprivilege’ grants the right to debug any kernal process. Program debugging should
never be done in a production environment. In the event it is required, grant rights for a short
time.
4.4.2.15 Deny access to this computer from the network
sedenynetworklogonright = *S-1-5-32-546, *S-1-5-7
The ‘sedenynetworklogonright’ prevents access for a variety of network protocols. The policy
applies the right to Guests and ANONYMOUS LOGON. The Administrators must add the local
accounts ‘Guest’, ‘Support_388945a0’ and Built-in Administrator account.
NOTE:
Given no reason for network access to the system for a group or user, access should
be denied.
4.4.2.16 Deny log on as a batch job
sedenybatchlogonright = *S-1-5-32-546, *S-1-5-7
The ‘sedenybatchlogonright‘ prevents the ability to create batch jobs. This policy applies rights
to Guests and ANONYMOUS LOGON. The Administrators must add the local accounts ‘Guest’
and ‘Support_388945a0’. The batch facility could be used to schedule jobs that result in a DoS.
NOTE:
Given no reason for batch logon access to the system for a group or user, access
should be denied.
4.4.2.17 Deny log on as a service
sedenyservicelogonright = *S-1-5-32-546,*S-1-5-32-544, *S-1-5-7
The ‘sedenyservicelogonright’ prevents access to a variety of network protocols. This policy
applies the rights to Guests, ANONYMOUS LOGON, and Administrators. Administrators must
add the local accounts ‘Guest’, ‘Support_388945a0’ and Built-in Administrator account.
4.4.2.18 Deny log on locally
sedenyinteractivelogonright = *S-1-5-32-546, *S-1-5-7
The ‘sedenyinteractivelogonright’ prevents local access to the system. This policy applies the
rights to Guests and ANONYMOUS LOGON. Administrators must add the local accounts
‘Guest’ and ‘Support_388945a0’.
NOTE:
Given no reason for interactive access to the system for a group, access should be
denied.
52 March 2004 Server Policy Files