IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
onwards, these values can be specified centrally for the individual
workstations with the aid of System Policy Editor.
Loading of sub-systems
The optional sub-systems POSIX and OS/2 should, in fact, only remain
installed if they are also needed for executing applications. If this is not the
case, their installation should not take place or, if it has already occurred, the
systems should be deleted again. To do this the sub-directories POSIX and
OS2 of the Windows system directory %SystemRoot%\SYSTEM32 should be
deleted along with any of their sub-directories. Furthermore, the following
programs and loadable libraries in the Windows directory
%SystemRoot%\SYSTEM32 should be deleted:
- OS/2:
OS2.EXE
OS2SRV.EXE
OS2SS.EXE
- POSIX: PSXDLL.DLL
PAX.EXE
POSIX.EXE
PSXSS.EXE
Furthermore the following values in the key
\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems in
HKEY_LOCAL_MACHINE of the registry have to be deleted:
- OS/2: "Os2" with the value %SystemRoot%\system32\os2ss.exe
- POSIX: "Posix" with the value %SystemRoot%\system32\psxxx.exe
Starting of services
If services which are not standard services of Windows NT are to be
configured, when determining the start type of these services (using the
system control option "Services") provision should be made, if possible, for a
separate user account to start each of these services, in order to be able to
restrict the authorisations of the service concerned in a suitable manner. The
user account used in such cases must have the right "Start as service", and it
should not be used except for this service, i.e. in particular it should also not
allow users to log in. Services which have not been allocated in this way to a
special user account, run in the context of the special user group SYSTEM (see
S 4.50 Structured system administration under Windows NT), i.e. generally
with the most extensive access permissions.
Device protection
If the computer has disk drives, CD ROM drives and/or tape drives, these
should, if possible, be specifically protected, as outlined in Safeguard S 4.52
Equipment protection under Windows NT.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000