The Internet Encyclopedia (Volume 3)

P1: GSB/FFX P2: GSB/FFX QC: IML/FFX T1: IML

WL040C-63 WL040/Bidgoli-Vol III-Ch-64 June 23, 2003 16:45 Char Count= 0

802 WINDOWS2000 SECURITY

people are trying to logon to this account—a decoy ac-

count designed to deflect genuine attacks against your

system.


Leave the Guest account disabled.


Severely restrict the membership in the Enterprise

Admins, Schema Admins, and Administrators groups,

all of which have an incredible amount of power.

Go to Administrative Tools,then either Domain Secu-

rity Policy or Local Security Policy (depending on the par-

ticular version, workstation or server, of W2K) and then

to Security Settings:

Go to Account Policies, then Password Policy to set the

following parameter values:

Enforce password history 24

Maximum password age 90 days

Minimum password age 5 days

Minimum password length 8

Passwords must meet complexity

requirements

Enabled

Store passwords using reversible

encryption

Yes (unless your

domain has WaX

and Me clients)

Go to Account Policies, then Account Lockout Policy to

set the following parameters:

Account lockout duration 60 min

Account lockout threshold 5

Reset account lockout after 60 min

Go to Domain Security Policy, then Active Directory

Users and Groups or Local Security Policy, then Com-

puter Management (again depending on the particular

version of W2K you are running). Find the Users and

Groups Container and double click on it. For each user

account, set the following Account Options


User must change Password at Next Logon: ensure this

is clicked whenever a new account is created to help

ensure privacy of user passwords (User Cannot Change

Password—do notclick on this)


Password Never Expires—do not click on this except in

the case of the default Administrator account and spe-

cial accounts that have been installed for the sake of

applications


Account Is Disabled—be sure to confirm that the follow-

ing accounts are disabled: Guest, accounts of employees

who are no longer with your organization, accounts of

employees who are on leave, and (unless your system is

running an IIS web server) the IUSR and IWAM ac-

counts. Disable these accounts by clicking on “Account

Is Disabled” for each if they are not already marked with

a red “X.”

Set the following Security Options by going to Ad-

ministrative Tools, then either Domain Security Policy or

Local Security Policy (depending on the version of W2K

each system runs), then to Security Settings, then to Local

Policies, and finally to Security Options. Double click on

the Security Options container. Double click on the option

of your choice to either enable or disable it.

Enable “Security restrictions for anonymous” to prevent

anyone who connects to a W2K system via a null session

from being able to enumerate shares and SIDs (Security

Identifiers)


Enable “Clear Virtual Memory Pagefile When System

Shuts Down” to protect against an attacker gleaning

sensitive information from pagefile.sys if the attacker is

able to gain physical access to a system and boot from

a Linux or other disk


Do notchoose “Shut Down the Computer when the Se-

curity Log is Full,” “Recovery Console: Allow Automatic

Administrative Logon,” and “Allow Server Operators to

Schedule Tasks.”

Set a Baseline of Logging

Go to Administrative Tools, then either Domain Security

Policy or Local Security Policy (depending on the version

of W2K your system runs), then to Security Settings, then

to Local Policies, then to Audit Policy. Double click on the

Audit Policy container to view the audit options. To en-

able any type of auditing, double click on the name and

in the sheet that will appear (under Audit these Attempts)

click on both Success and Failure. At a minimum enable

“Audit account logon events.” If you need higher levels of

auditing, enable additional types of auditing such as “Au-

dit logon events,” “Audit account management,” “Audit

policy change,” and “Audit privilege use.”

Set Logging Properties for the Security Log

Go to Administrative Tools, then Event Viewer. Click on

Security and right click to Properties. Set Maximum Log

size to at least 5000K and (under “When maximum log

size is reached”) click on “Overwrite as needed.”

Check Your System’s Logs Regularly (Daily, If Possible)

Doing this will help determine whether your system has

been attacked or if someone has tampered with it.

Ensure That Only the Bare Minimum of Services

Needed Are Running

Disable any unnecessary services by going to Administra-

tive Tools, then Services. Highlight the name of each un-

necessary service, double click, then under Service Status

click on Stop and under Startup Type set this to Manual.

The following are services that are usuallynotneeded in

W2K:


Computer Brower


FTP


IIS Admin Service (this is needed for IIS Web and FTP

servers)


Indexing Service


Messenger


Print Spooler (unless a local printer is attached to the

system)


Remote Access Service


SNMP