Windows Server 2003 Recommended Baseline Security

More documents

Recommendations

Info

Unclassified ITSG for Windows Server 2003 4.4.2.25 Load and unload device drivers seloaddriverprivilege = *S-1-5-32-544 The ‘seloaddriverprivilege’ grants the right to load and unload device drivers. This policy grants privileges to Administrators. The driver code is run with elevated privileges. By restricting privileges to Administrators, the exposure is reduced. 4.4.2.26 Lock pages in memory selockmemoryprivilege = The ‘selockmemoryprivilege’ grants the right to keep data in physical memory. This policy grants privileges to no one. The abuse of privileges can result in starved memory resources and a DoS situation. Restricting this privilege reduces exposure to this threat. 4.4.2.27 Log on as a batch job sebatchlogonright = The ‘sebatchlogonright’ grants the right to submit batch jobs (log on as a batch job). This policy grants rights to noone. The Task Scheduler could cause a DoS; limiting this privilege reduces the threat. 4.4.2.28 Log on as a service seservicelogonright = *S-1-5-20,*S-1-5-19 The ‘seservicelogonright’ grants the right to logon as a service. This policy grants rights to Local Service and Network Service. Interactive accounts are purposely excluded. 4.4.2.29 Manage auditing and security log sesecurityprivilege = *S-1-5-32-544 The ‘sesecurityprivilege’ grants the right to specify object access auditing options. This policy grants rights to Administrators. Administrators alone can determine the appropriate auditing level. This ensures that users of the system cannot reduce auditing and eliminate traces of their activity. 4.4.2.30 Modify firmware environment values sesystemenvironmentprivilege = *S-1-5-32-544 The ‘sesystemenvironmentprivilege’ grants rights to modify firmware environment values. This policy grants these rights to Administrators only. The ability to change system configurations needs to be controlled. 54 March 2004 Server Policy Files
Windows Server 2003 Recommended Baseline Security (ITSG-20) 4.4.2.31 Perform volume maintenance tasks semanagevolumeprivilege = *S-1-5-32-544 The ‘semanagevolumeprivilege’ grants rights to manage volumes or disks. This policy grants rights to Administrators only. The administrative function of volume and disk management can damage user data on a disk. Restricting this privilege reduces the threat. 4.4.2.32 Profile single process seprofilesingleprocessprivilege = *S-1-5-32-544 The ‘seprofilesingleprocessprivilege’ grants the right to monitor performance of a non-system process. This policy grants these rights to Administrators. The ability to profile a process can provide information to be used as a basis of an attack. Limiting privileges to Administrators reduces this threat. 4.4.2.33 Profile system performance sesystemprofileprivilege = *S-1-5-32-544 The ‘sesystemprofileprivilege’ grants the right to monitor performance of a system process. This policy grants these rights to Administrators only. Profiling a system gathers information useful for an attack. Limiting privileges to Administrators reduces this threat. 4.4.2.34 Remove computer from docking station seundockprivilege = *S-1-5-32-544 The ‘seundockprivilege’ grants the right to undock the server. This policy grants these privileges to Administrators only. As a preventive measure, these privileges are restricted. 4.4.2.35 Replace a process level token seassignprimarytokenprivilege = *S-1-5-19,*S-1-5-20 The ‘seassignprimarytokenprivilege’ grants the right to replace a process security token of a child process. These rights are ganted to Local Service and Network Service. This can be used to launch processes as another user, providing the ability to hide inappropriate activity on a system. 4.4.2.36 Restore files and directories serestoreprivilege = *S-1-5-32-544 The ‘serestoreprivilege’ grants the right to bypass permissions when restoring objects. This policy grants privileges to Administrators only. Due to the nature of the restore process, rights are restricted to accounts that are required to use it. Server Policy Files March 2004 55
Page 1 and 2:
IT Security Guidance Windows Server
Page 3 and 4:
Windows Server 2003 Recommended Bas
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Page 15:
Page 18 and 19:
Page 20 and 21:
Page 22 and 23:
Page 24 and 25: Windows Server 2003 Recommended Bas
Page 26 and 27: Windows Server 2003 Recommended Bas
Page 28 and 29: Unclassified ITSG for Windows Serve
Page 124 and 125:
Unclassified ITSG for Windows Serve
Page 126 and 127:
Page 128 and 129:
Page 130 and 131:
Page 132 and 133:
Page 134 and 135:
Page 136 and 137:
Page 138 and 139:
Page 140 and 141:
Page 142 and 143:
Page 144 and 145:
Page 146 and 147:
Page 148 and 149:
Page 150 and 151:
Page 152 and 153:
Page 154 and 155:
Page 156 and 157:
Page 158 and 159:
Page 160 and 161:
Page 162 and 163:
Page 164 and 165:
Page 166 and 167:
Page 168 and 169:
Page 170 and 171:
Page 172 and 173:
Page 174 and 175:
Page 176 and 177:
Page 178 and 179:
Page 180 and 181:
Page 182 and 183:
Page 184 and 185:
Page 186 and 187:
Page 188 and 189:
Page 190 and 191:
Page 192 and 193:
Page 194 and 195:
Page 196 and 197:
Page 198 and 199:
Page 200 and 201:
Page 202 and 203:
show all

Windows Server 2003 Recommended Baseline Security

Create successful ePaper yourself

Delete template?

Save as template?