IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
the entry "LMCompatibilityLevel" of type "REG_DWORD" with the value
"2".
A Windows NT computer thus modified is no longer able to access resources
located on computers which do not recognise the Windows NT authentication
scheme. This includes, for example, all computers running under the Windows
95 operating system.
On domain controllers, it is not sufficient to deny the "Administrators" group
the right designated "Access to this computer from the network", because on
such controllers, the pre-defined administrator account is automatically made
a member of the "Domain Admins" and "Domain Users" groups. For this
reason, the pre-defined administrator account should be removed from the
"Domain Admins" group. This can be done as long as this account remains a
member of the "Administrators" group. The pre-defined administrator account
should also be removed from the "Domain Users" group. However, this is not
directly possible, as this group is the primary group of the account.
Consequently, an arbitrary, global group must first be created which does not
possess the right designated "Access to this computer from the network". The
pre-defined administrator account is to be added to this group, which should
be set such that it becomes the primary group of the account. Afterwards the
pre-defined administrator account can be removed from the "Domain Users "
group.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000