Windows Server 2003 Recommended Baseline Security

Unclassified ITSG for Windows Server 2003
4.5.1.3 Maximum system log size
MaximumLogSize = 76800 (in [System Log] section
The ‘MaximumLogSize’ determines the size of the System event log. The setting ‘76800’ creates
a 76800 KB log file. With an average of 500 bytes per event, this log file will accommodate over
153,000 events. This allows the system to run for an extended period-of-time without having to
roll the log file.
NOTE:
Due to the wide variety of event loads, we recommend monitoring the log files during
the initial operational period.
4.5.2 Guest Access
4.5.2.1 Prevent local Guests group from accessing Applications, Security, and System
logs
RestrictGuestAccess = 1(in [Application Log] or [Security Log] or [System Log] section)
The ‘RestrictGuestAccess’ keyword determines if accounts with ‘guest’ access can access the
log. The setting ‘1’ disallows guest access to the log. Access to log information provides an
attacker with valuable information to mount attacks on the system or users. As a result, only
users who are authenticated are given access to the log files.
4.5.3 Retention Method
4.5.3.1 Retention method for application log
AuditLogRetentionPeriod = 2(in [Application Log] or [Security Log] or [System Log] section)
The ‘AuditLogRetentionPeriod’ keyword determines the system behaviour when the log is full.
The setting ‘2’ shuts the system down if the log cannot be written. Use of this setting should be
consistent with departmental log retention policy.
4.6 System Services
A large number of services are disabled in this guide. With each disabled service, we provide
justification for the recommendation. In some cases, a more flexible approach may be needed.
It is important to note that a disabled service may only be required occasionally. For example,
the Performance Logs and Alerts service is disabled. However, to help fulfill a specific
temporary need, the Administrator could enable a service, resolve an issue, and return the service
to the original configuration.
70 March 2004 Server Policy Files