22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

372 Lotus Security Handbook<br />

HKEY_LOCAL_MACHINE\SOFTWARE<br />

\Microsoft\Windows NT\CurrentVersion\Winlogon<br />

CachedLogonsCount<br />

► Commonly attacked Registry keys should have their access restricted via<br />

ACLs. The following Registry keys at the very least should be protected by<br />

providing read-only access to Everyone, and Full-Control to Administrators<br />

and SYSTEM only. Creator Owner should be given Full-Owner control:<br />

HKEY_LOCAL_MACHINE\SOFTWARE<br />

\Microsoft\Windows\CurrentVersion\Run<br />

HKEY_LOCAL_MACHINE\SOFTWARE<br />

\Microsoft\Windows\CurrentVersion\RunOnce<br />

HKEY_LOCAL_MACHINE\SOFTWARE<br />

\Microsoft\Windows\CurrentVersion\RunOnceEx<br />

HKEY_LOCAL_MACHINE\SOFTWARE<br />

\Microsoft\Windows NT\CurrentVersion\AeDebug<br />

HKEY_LOCAL_MACHINE\SOFTWARE<br />

\Microsoft\Windows NT\CurrentVersion\WinLogon<br />

Windows NT 4.0 logging<br />

There are several automated logging services built in to Windows NT 4.0. Most<br />

services use the EventLogs that every good Windows system administrator<br />

should be familiar with.<br />

Note: The logging features described here apply to later versions of the<br />

Windows operating system as well, but are only <strong>cover</strong>ed in this section.<br />

If the server is running any Internet services (such as FTP, HTTP, SMTP, and so<br />

on), they are logged through a different facility. It is quite likely that the<br />

Performance Monitor application will be used to tune or troubleshoot the server.<br />

This application does not log to the Application log of the EventLog service, but<br />

rather to its own set of logs.<br />

Finally, one of the more important aspects of the system, scheduling of<br />

automated jobs, is logged through yet another service. Because there is no<br />

normal centralized logging service in Windows NT, each must be addressed<br />

individually.<br />

The first thing to do is to move all logs to a separate logging partition. It would be<br />

convenient, although not 100% necessary, to have this partition be a separate<br />

disk, so as to not impact performance for the data portion of the server. After a

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!