Windows Server 2003 Recommended Baseline Security

More documents

Recommendations

Info

Unclassified ITSG for Windows Server 2003 4.4.2.37 Shut down the system seshutdownprivilege = *S-1-5-32-544 The ‘seshutdownprivilege’ grants the right to shut down the system locally. This policy grants the right to Administrators only. By restricting this privilege, the threat of inadevertent or malicious shutdowns is reduced. 4.4.2.38 Synchronize directory service data sesyncagentprivilege = The ‘sesyncagentprivilege’ grants the right to read all objects and properties in the Directory. This policy revokes all privilege. Information gained from the Active Directory can be used to form an attack against the system. 4.4.2.39 Take ownership of files or other objects setakeownershipprivilege = *S-1-5-32-544 The ‘setakeownershipprivilege’ grants the right to take ownership of any securable object in the system. The act of changing ownership will be recorded in the logs. This policy grants privileges to Administrators only. 4.4.3 Security Options This section includes values for all entries in the Security Options section of the policy GUI. It incorporates entries in the Security Options section of the Domain Policy as well as the Member Server Baseline. Please note all values are explicitly defined. This ensures that security is not dependent on default values. 4.4.3.1 Accounts: Administrator account status EnableAdminAccount = 0 The ‘EnableAdminAccount’ determines if the local administrator account is enabled. The setting ‘0’ disables the local administrator account. This prevents widespread use and removes it as a target for attack. 4.4.3.2 Accounts: Guest account status EnableGuestAccount = 0 The ‘EnableGuestAccount‘ determines if the local guest account is enabled. The setting ‘0’ disables the local guest account. This prevents widespread use and removes it as a target for attack. 56 March 2004 Server Policy Files
Windows Server 2003 Recommended Baseline Security (ITSG-20) 4.4.3.3 Accounts: Limit local account use of blank passwords to console logon only machine\system\currentcontrolset\control\lsa\limitblankpassworduse=4, 1 The ‘limitblankpassworduse’ registry value determines if local accounts with blank passwords can be used to logon remotely. The setting ‘1’ disallows accounts with blank passwords to logon remotely. This ensures remote access requires an account name and password. 4.4.3.4 Accounts: Rename administrator account NewAdministratorName = "johnsmith" The ‘NewAdministratorName’ keyword sets the local administrator account name. The setting ‘johnsmith’ renames the local administrator account to johnsmith. Renaming the local administrator account makes it difficult for an attacker to misuse it. NOTE: This keyword should be omitted if a policy to rename the Administrator account on each system is enforced. If not, then at a minimum change it from ‘johnsmith’ to a local value. 4.4.3.5 Accounts: Rename guest account NewGuestName = "janesmith" The ‘NewGuestName’ keyword sets the local guest account name. The setting ‘janesmith’ renames the local guest account to janesmith. Renaming the account makes it more difficult for an attacker to misuse it. NOTE: This keyword should be omitted if a policy to rename the Guest account on each system is enforced. If not, then at a minimum change it from ‘janesmith’ to a local value. 4.4.3.6 Audit: Audit the access of global system objects machine\system\currentcontrolset\control\lsa\auditbaseobjects=4, 0 The ‘auditbaseobjects’ registry setting determines if access to global system objects is audited. The setting ‘0’ disables audit access to global objects. 4.4.3.7 Audit: Audit the use of Backup and Restore privilege machine\system\currentcontrolset\control\lsa\fullprivilegeauditing=3, 0 The ‘fullprivilegeauditing’ determines if the system will audit the Backup and Restore privilege. The setting ‘0’ disables the audit of Backup and Restore privilege. Server Policy Files March 2004 57
Page 1 and 2:
IT Security Guidance Windows Server
Page 3 and 4:
Windows Server 2003 Recommended Bas
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Page 15:
Page 18 and 19:
Page 20 and 21:
Page 22 and 23:
Page 24 and 25:
Page 26 and 27: Windows Server 2003 Recommended Bas
Page 28 and 29: Unclassified ITSG for Windows Serve
Page 126 and 127:
Unclassified ITSG for Windows Serve
Page 128 and 129:
Page 130 and 131:
Page 132 and 133:
Page 134 and 135:
Page 136 and 137:
Page 138 and 139:
Page 140 and 141:
Page 142 and 143:
Page 144 and 145:
Page 146 and 147:
Page 148 and 149:
Page 150 and 151:
Page 152 and 153:
Page 154 and 155:
Page 156 and 157:
Page 158 and 159:
Page 160 and 161:
Page 162 and 163:
Page 164 and 165:
Page 166 and 167:
Page 168 and 169:
Page 170 and 171:
Page 172 and 173:
Page 174 and 175:
Page 176 and 177:
Page 178 and 179:
Page 180 and 181:
Page 182 and 183:
Page 184 and 185:
Page 186 and 187:
Page 188 and 189:
Page 190 and 191:
Page 192 and 193:
Page 194 and 195:
Page 196 and 197:
Page 198 and 199:
Page 200 and 201:
Page 202 and 203:
show all

Windows Server 2003 Recommended Baseline Security

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?