Windows Server 2003 Recommended Baseline Security

Unclassified ITSG for Windows Server 2003
4.4.2.25 Load and unload device drivers
seloaddriverprivilege = *S-1-5-32-544
The ‘seloaddriverprivilege’ grants the right to load and unload device drivers. This policy grants
privileges to Administrators. The driver code is run with elevated privileges. By restricting
privileges to Administrators, the exposure is reduced.
4.4.2.26 Lock pages in memory
selockmemoryprivilege =
The ‘selockmemoryprivilege’ grants the right to keep data in physical memory. This policy
grants privileges to no one. The abuse of privileges can result in starved memory resources and a
DoS situation. Restricting this privilege reduces exposure to this threat.
4.4.2.27 Log on as a batch job
sebatchlogonright =
The ‘sebatchlogonright’ grants the right to submit batch jobs (log on as a batch job). This policy
grants rights to noone. The Task Scheduler could cause a DoS; limiting this privilege reduces the
threat.
4.4.2.28 Log on as a service
seservicelogonright = *S-1-5-20,*S-1-5-19
The ‘seservicelogonright’ grants the right to logon as a service. This policy grants rights to Local
Service and Network Service. Interactive accounts are purposely excluded.
4.4.2.29 Manage auditing and security log
sesecurityprivilege = *S-1-5-32-544
The ‘sesecurityprivilege’ grants the right to specify object access auditing options. This policy
grants rights to Administrators. Administrators alone can determine the appropriate auditing
level. This ensures that users of the system cannot reduce auditing and eliminate traces of their
activity.
4.4.2.30 Modify firmware environment values
sesystemenvironmentprivilege = *S-1-5-32-544
The ‘sesystemenvironmentprivilege’ grants rights to modify firmware environment values. This
policy grants these rights to Administrators only. The ability to change system configurations
needs to be controlled.
54 March 2004 Server Policy Files