Windows Server 2003 Recommended Baseline Security
Windows Server 2003 Recommended Baseline Security
Windows Server 2003 Recommended Baseline Security
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>Windows</strong> <strong>Server</strong> <strong>2003</strong><br />
<strong>Recommended</strong> <strong>Baseline</strong> <strong>Security</strong> (ITSG-20)<br />
4.4.3.36 Microsoft network server: Amount of idle time required before suspending<br />
session<br />
machine\system\currentcontrolset\services\lanmanserver\parameters\autodisconnect=4, 15<br />
The ‘autodisconnect’ registry setting defines the amount of idle time in minutes before an SMB<br />
session is suspended. The setting ‘15’ suspends the SMB session after fifteen minutes of idle<br />
time. An idle session consumes resources. Attackers could set up sessions consuming resources<br />
to initiate a DoS attack. Additionally, idle sessions can cause SMB services to become slow or<br />
unresponsive.<br />
4.4.3.37 Microsoft network server: Digitally sign communications (always)<br />
machine\system\currentcontrolset\services\lanmanserver\parameters\requiresecuritysignature<br />
=4, 1<br />
The ‘requiresecuritysignature’ registry value determines if the server will always sign SMB<br />
communications. The setting ‘1’ always digitally signs SMB communications. This setting<br />
provides mutual authentication for all communication. Mutual authentication may prevent manin-the-middle<br />
attacks and eliminate session hijacking. Legacy (i.e. Pre-<strong>Windows</strong> 2000) systems<br />
cannot support this requirement.<br />
4.4.3.38 Microsoft network server: Digitally sign communications (if client agrees)<br />
machine\system\currentcontrolset\services\lanmanserver\parameters\enablesecuritysignature=<br />
4, 1<br />
The ‘enablesecuritysignature’ registry value signs SMB communications, if the client agrees.<br />
The setting ‘1’ signs SMB communications. This setting provides mutual authentication for all<br />
communication. Mutual authenitcation may prevent man-in-the-middle attacks and eliminate the<br />
session hijacking. Legacy (i.e. Pre-<strong>Windows</strong> 2000) systems cannot support this requirement.<br />
4.4.3.39 Microsoft network server: Disconnect clients when logon hours expire<br />
machine\system\currentcontrolset\services\lanmanserver\parameters\enableforcedlogoff=4, 1<br />
The ‘enableforcedlogoff’ registry value determines if a network connected user is disconnected<br />
outside of their hours of operation. The setting ‘1’ disconnects the user when logged on outside<br />
of their hours of operation.<br />
4.4.3.40 Network access: Allow anonymous SID/Name translation<br />
LSAAnonymousNameLookup = 0<br />
The ‘LSAAnonymousNameLookup’ determines if the system allows anonymous SID/NAME<br />
translation. The setting ‘0’ disallows the system to perform anonymous SID/NAME translation.<br />
If enabled, a user could use a well-known account SID to obtain usernames of the account. This<br />
may then be used to initiate a password guessing attack.<br />
<strong>Server</strong> Policy Files March 2004 63
Change language