IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
system control, are stored in the standing file called Profiles in the file
NTUSER.DAT.
The following options can be used under version 3.51, in order to restrict the
capabilities of users for working with Windows NT in various respects:
- Settings for Program Manager: It can be specified here whether programs
may be started via “File - Execute“, whether the current settings may be
stored and whether general program groups are listed. In addition, the autostart
group can be determined.
- Settings for program groups: Here, access to designated program groups
can be locked out and for program groups which are not locked out,
various amendment authorisations can be allocated.
- Users can be allowed or forbidden to connect and disconnect network
printers via Print Manager.
- Waiting for the execution of the log-on script can be forced before Program
Manager is started. This option should always be activated, so that the
actions specified in the log-on script are performed in any event.
As from version 4.0, the following restrictions can be laid down with the aid
of System Policy Editor:
- Control Panel: Here, access can be limited to the control panel option
"Display". If this option was chosen, in addition the register cards
"Background", "Screen Saver", "Appearance" and "Settings" can be still be
masked individually, and the option "Display" can also be deactivated as a
whole.
Access to the control panel should be withdrawn from normal users, as
unintentional changes to the system settings can cause problems. If, in
addition, access to the control panel option "Display" and the register card
"Screen Saver" is withdrawn, users can be prevented from deactivating the
screen lock. Then, when setting up users, the administrator naturally has to
activate the screen lock.
- Shell: Here the following restrictions can be laid down:
- Remove "Execute" command
- Remove folder under Settings in the "Start" menu
- Remove "Task bar" under settings in the "Start" menu
- Remove "Find" command
- Mask drives in the "My Computer" window
- Mask network environment
- No "Entire Network" symbol in the network environment
- No workgroups computers in network environment
- Mask all desktop components
- Deactivate "Shut Down" command
- Do not store settings when ending
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000