Windows Server 2003 Recommended Baseline Security

Windows Server 2003
Recommended Baseline Security (ITSG-20)
is predicated on the CTL+ALT+DEL key sequence to initiate user authentication. It provides
unassailable hardware initiation of the logon sequence; this helps thwart Trojan Horse routines.
4.4.3.26 Interactive logon: Message text for users attempting to logon
machine\software\microsoft\windows\currentversion\policies\system\legalnoticetext=7,
DEPARTMENTAL TEXT FOR USER LOGON MUST BE SUPPLIED
The ‘legalnoticetext’ registry value is presented to the user prior to entry of username and
password. The value shown is the text presented. This may help an organization in the event of
legal proceedings.
4.4.3.27 Interactive logon: Message title for users attempting to logon
machine\software\microsoft\windows\currentversion\policies\system\legalnoticecaption=1
“DEPARTMENTAL TEXT FOR USER LOGON MUST BE SUPPLIED”
The ‘legalnoticecaption’ registry value is presented to the user as the title of the window that
contains the ‘legalnoticetext’ text. The value shown is the text presented. This may help an
organization in the event of legal proceedings.
4.4.3.28 Interactive logon: Number of previous logons to cache (in case domain controller
is not available)
machine\software\microsoft\windowsnt\currentversion\winlogon\cachedlogonscount=1,"0"
The ‘cachedlogonscount’ registry value determines the number of unique user whom logon
information is locally cached. The setting ‘0’ does not cache logon information locally. This
ensures the user establishes a current security token with the Domain Controller. This prevents
disabled users access via cached logon credentials.
4.4.3.29 Interactive logon: Prompt user to change password before expiration
machine\software\microsoft\windowsnt\currentversion\winlogon\passwordexpirywarning=4,
14
The ‘passwordexpirywarning’ registry value determines how many days in advance the user is
notified of password expiration. This setting warns the user 14 days before password expiry. The
user will continue to be reminded until the password expiry date.
4.4.3.30 Interactive logon: Require Domain Controller authentication to unlock
workstation
machine\software\microsoft\windows nt\currentversion\winlogon\forceunlocklogon=4, 1
The ‘forceunlocklogon’ registry value determines if a domain controller must be contacted to
unlock a computer. The setting ‘1’ requires contact with a domain controller. This ensures the
user establishes a current security token with the Domain Controller. This also disallows disabled
users access via cached logon credentials.
Server Policy Files March 2004 61