Windows Server 2003 Recommended Baseline Security

Windows Server 2003
Recommended Baseline Security (ITSG-20)
4.4.3.56 Network security: Minimum session security for NTLM SSP based (including
secure RPC) servers
machine\system\currentcontrolset\control\lsa\msv1_0\ntlmminserversec=4, 537395248
The ‘ntlmminserversec’ registry value defines the minimum session security for NTLM SSP
based (including secure RPC) servers. The setting ‘537395248’ enables all options, as
recommended. This requires message integrity, confidentiality, NTLMv2 session security and
128-bit encryption be used for logon.
4.4.3.57 Recovery console: Allow automatic administrative logon
machine\software\microsoft\windowsnt\currentversion\setup\recoveryconsole\securitylevel=4,
0
The ‘securitylevel’ value determines if the recovery console requires an Administrator password
to logon. The setting ‘0’ requires an Administrators password. Enabling this setting to allow
anyone to shut down a server is not recommended.
4.4.3.58 Recovery console: Allow floppy copy and access to all drives and all folders
machine\software\microsoft\windowsnt\currentversion\setup\recoveryconsole\setcommand=4,
0
The ‘setcommand’ registry value determines if the Recovery Console ‘SET’ command is
available. The setting ‘4’ disables the ‘SET’ command. (e.g. Copy to removable media is
disabled).
4.4.3.59 Shutdown: Allow system to be shut down without having to log on
machine\software\microsoft\windows\currentversion\policies\system\shutdownwithoutlogon=4
, 0
The ‘shutdownwithoutlogon’ registry value determines if the system can be shutdown without
the user logged on. The setting ‘0’ requires the user to logon. This ensures only authorized users
may shut down the system.
4.4.3.60 Shutdown: Clear virtual memory page file
machine\system\currentcontrolset\control\sessionmanager\memory\management\clearpagefile
atshutdown=4, 1
The ‘clearpagefileatshutdown’ value determines if page file contents are overwritten on a clean
shutdown. The setting ‘1’ causes clears the page file on a normal shutdown. Sensitive system and
user information may be contained in the page file. By ensuring it is cleared, the risk that
information be available to an attacker is reduced.
Server Policy Files March 2004 67