Windows Server 2003 Recommended Baseline Security

Windows Server 2003
Recommended Baseline Security (ITSG-20)
4.4.2.19 Deny log on through Terminal Services
sedenyremoteinteractivelogonright = *S-1-5-32-546, *S-1-5-7
The ‘sedenyremoteinteractivelogonright’ prevents logon through terminal services. This policy
applies rights to Guests and ANONYMOUS LOGON. Administrators must add the local
accounts ‘Guest’, ‘Support_388945a0’ and Built-in Administrator.
NOTE:
Given no reason for terminal services access for a group, access should be denied.
4.4.2.20 Enable computer and user accounts to be trusted for delegation
seenabledelegationprivilege =
The ‘seenabledelegationprivilege’ grants the right to change the ‘trusted for delegation’ setting
on Active Diretory objects. This policy does not grant privileges to anyone. The misuse of this
privilege could lead to impersonation of users in a Domain.
4.4.2.21 Force shutdown from a remote system
seremoteshutdownprivilege =
The ‘seremoteshutdownprivilege’ grants the right to shut the system down from a remote
location. This policy grants rights to noone. Servers in a High Security zone require physical
access to be shut down.
4.4.2.22 Generate security audits
seauditprivilege = *S-1-5-19,*S-1-5-20
The ‘seauditprivilege’ grants the right to generate records in the security logs. This policy grants
rights to NETWORK SERVICE and LOCAL SERVICE. By limiting rights to non-interactive
accounts, DoS conditions through full logs can be avoided.
4.4.2.23 Impersonate a client after authentication
seimpersonateprivilege = *S-1-5-19,*S-1-5-20
The ‘seimpersonateprivilege’ grants the right for applications to impersonate that client. This
policy grants rights to Local Service and Network Service. For better security, privileges are
limited to non-interactive accounts.
4.4.2.24 Increase scheduling priority
seincreasebasepriorityprivilege = *S-1-5-32-544
The ‘seincreasebasepriorityprivilege’ grants the right to increase process priority. This policy
grants privileges to Administrators. If misused, a DoS condition could starve CPU resources.
Server Policy Files March 2004 53