Front cover - IBM Redbooks

Windows 2000 policies
If hardening Windows NT 4.0 seemed a little haphazard, this is true. There is no
easy way to define and apply all Registry, file system, network, and user/group
policy changes. Even worse, there is no easy way to audit the changes made to
ensure that the policy changes have not been undone by intruders, installed
software, or applied Service Packs.
With the release of Windows 2000, Microsoft introduced a wonderful set of
snap-in tools for the Microsoft Management Console (MMC). The Security
Templates Tool allows system administrators to select, review, and even define
custom security policy templates. The Security Configuration and Analysis Tool
allows the system administrators to not only apply all those policies in one simple
action, but it also allows them to audit those changes to see what has changed.
By default, the Security Templates Tool and Security Configuration and Analysis
Tool are not visible in the MMC. These two snap-ins should be added to manage
the server's policies and settings.
There are many bundled security templates, including High Security for
Workstations, which is defined in the template HISECWS.INF. Additionally,
Microsoft has made available a High Security Template targeted for Web
servers. The security template includes most of the policy and Registry changes
made previously for Windows NT 4.0. The HISECWEB.INF security template is
available from Microsoft at the following URL:
http://support.microsoft.com/support/misc/kblookup.asp?id=Q316347
Perform the following steps to use the template:
1. Copy the template to the %windir%\security\templates directory.
2. Open the Security Templates tool, and look over the settings.
3. Open the Security Configuration and Analysis tool, and load the template.
4. Right-click the Security Configuration and Analysis tool, and choose “Analyze
Computer Now” from the context menu.
5. Wait for the work to complete.
6. Review the findings, and update the template as necessary.
Take some time to browse through and read the individual templates. You can
do this by using the Security Templates Tool or manually using a text editor such
as WordPad. Read through the suggested changes to determine if they make
sense for the deployment of the particular application intended to run on the IT
system. The Security Templates Tool can be used to develop an individual
security template based on an existing template. After obtaining a template that
Chapter 9. Server hardening 377