Windows Server 2003 Recommended Baseline Security

Unclassified ITSG for Windows Server 2003
4.4.3.61 System cryptography: Force strong key protection for user keys stored on the
computer
machine\software\policies\microsoft\cryptography\forcekeyprotection=4, 2
The ‘forcekeyprotection’ value determines if user keys (e.g. SMIME) require a password each
time they are to be used. The setting ‘2’ requires entry of a password each time a private key is
used. This ensures that a session that requires key material is used with the owner’s knowledge.
4.4.3.62 System cryptography: Use FIPS compliant algorithms for encryption, hashing,
and signing
machine\system\currentcontrolset\control\lsa\fipsalgorithmpolicy=4, 1
The ‘fipsalgorithmpolicy’ determines if Transport Layer Security / Secure Socket Layer
(TLS/SSL) Security Provider supports only TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher
suite. The setting ‘1’ requires the use of the TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher
suite. In the Federal Government, this setting is required for all servers to remain compliant to
cryptographic policies.
4.4.3.63 System objects: Default owner for objects created by members of the
Administrators group
machine\system\currentcontrolset\control\lsa\nodefaultadminowner=4, 1
The ‘nodefaultadminowner’ value determines if objects created by members of the
Administrators group are owned by the group or the object creator. The setting ‘1’ makes objects
owned by the creator. This ensures actions of an individual administrator can be isolated and
audited.
4.4.3.64 System objects: Require case insensitivity for non-Windows subsystems
machine\system\currentcontrolset\control\session manager\kernel\obcaseinsensitive=4, 1
The ‘obcaseinsensitive’ value determines if case insensitivity is required for non-Windows
subsystems. The setting ‘1’ requires case insensitivity for non-Windows subsystems. This
disables the ability for non-Windows sub-systems to create files that are inaccessible to the
Windows system. It also disables the ability to block access to other files with the same name in
upper case.
4.4.3.65 System objects: Strengthen default permissions of internal system objects (e.g.
Symbolic Links)
machine\system\currentcontrolset\control\session manager\protectionmode=4, 1
The ‘protectionmode’ registry setting determines if permissions on internal system objects (e.g.
symbolic links) is strengthened. The setting ‘1’ strengthens protection on internal system objects.
It allows non-administrators to view shared objects they did not create, but not modify.
68 March 2004 Server Policy Files