,

ISBN:, Edition: ,

Price: -

Table of Contents

Chapter 1 Important Information on Using this Guide ~ 1

Assumptions ~ 1
Warnings to Review Before Using this Guide ~ 2
Conventions and Commonly Used Terms ~ 2
Users and Authenticated Users ~ 2
System Variables ~ 3
Administrative Tools location ~ 3
About the Guide to Securing Microsoft Windows XP ~ 3

Chapter 2 What's New in Windows XP Security ~ 7

Changes to Security Features ~ 7
Everyone group membership ~ 7
Administrative ownership ~ 7
Installation of printers ~ 7
Blank password restriction ~ 7
Convert.exe ~ 8
Subsystems ~ 8
Encrypting File System ~ 8
New Security Features ~ 8
Software Restriction Policies ~ 8
Stored user names and passwords ~ 9
New Service Accounts ~ 9
LocalSystem Account ~ 9
Network Service Account ~ 9
Local Service Account ~ 10

Chapter 3 Introduction to the Security Configuration Manager Tools ~ 11

Security Configuration Functionality ~ 12
The Security Configuration GUI ~ 12
The Security Configuration Command Line Tool ~ 12
Security Templates ~ 13
Loading the Security Templates Snap-in into the MMC ~ 13
Viewing the Text of Security Templates ~ 14
Security Configuration Files ~ 14
Default Security Templates ~ 15
Microsoft-provided Templates ~ 15
NSA Security Template ~ 15
Before Making Security Changes ~ 15
Checklist for Applying the Recommendations in this Guide ~ 15

Chapter 4 Modifying Account Policy Settings with Security Templates ~ 19

Password Policy ~ 19
Account Lockout Policy ~ 22
Kerberos Policy ~ 23

Chapter 5 Modifying Local Policy Settings with Security Templates ~ 25

Auditing Policy ~ 25
User Rights Assignment ~ 28
Security Options ~ 32
Adding an Entry to Security Options ~ 47
Deleting customized options ~ 48

Chapter 6 Modifying Event Log Settings with Security Templates ~ 49

Event Log Settings ~ 49
Managing the Event Logs ~ 50
Saving And Clearing the Audit Logs ~ 50
Resetting the Audit Log Settings After the System Halts ~ 51

Chapter 7 Managing Restricted Groups with Security Templates ~ 53

Modifying Restricted Groups via the Security Templates Snap-in ~ 53

Chapter 8 Managing System Services with Security Templates ~ 55

Modifying System Services via the Security Templates Snap-in ~ 55
System Services Security ~ 57

Chapter 9 Modifying Registry Security Settings with Security Templates ~ 59

Inheritance model ~ 59
Registry permissions ~ 59
Effective Permissions ~ 61
Modifying Registry settings via the Security Templates snap-in ~ 61
Modifying Permissions on a Registry Key ~ 61
Adding registry keys to the security configuration ~ 64
Excluding registry keys from the security configuration ~ 65
Recommended Registry Key Permissions ~ 65

Chapter 10 Modifying File System Security Settings with Security Templates ~ 73

Converting to NTFS ~ 73
File and folder permissions ~ 74
Granularity of file permissions ~ 74
Folder Permissions: ~ 75
File Permissions: ~ 76
Effective Permissions. ~ ~ 76
Modifying File System settings via the Security Template snap-in ~ 76
Modifying Permissions on a File or Folder ~ 77
Adding files or folders to the security configuration ~ 79
Excluding files or folders from the security configuration ~ 79
Recommended File and Folder Permissions ~ 80

Chapter 11 Security Configuration and Analysis ~ 91

Loading the Security Configuration and Analysis Snap-in into the MMC ~ 91
Security Configuration Databases ~ 91
Secedit Command Line Options ~ 93
Performing a Security Analysis ~ 94
Performing a Security Analysis via the Command Line ~ 94
Performing a Security Analysis via the GUI ~ 94
Configuring a System ~ 95
Configuring a System via the Command Line ~ 95
Configuring a System via the GUI ~ 96

Chapter 12 Applying Windows XP Group Policy in a Windows 2000 Domain ~ 97

Overview ~ 97
Security Settings Extension ~ 97
Creating a Window XP GPO ~ 98
Importing a Security Template into a GPO ~ 98
Managing a Windows XP GPO from a Windows 2000 Domain Controller ~ 99
Local Group Policy Object ~ 100
Forcing a Group Policy Update ~ 100
Viewing the Resultant Set of Policy ~ 100
RSoP Snap-in ~ 100
Gpresult.exe ~ 101
Known Issues ~ 101
RestrictAnonymous Setting and "User must change password at next logon" ~ 101

Chapter 13 Remote Assistance/Desktop Configuration ~ 103

Remote Assistance ~ 103
Solicited Remote Assistance ~ 103
Remote Assistance Offers ~ 104
Remote Desktop Connections ~ 105
Group Policy - Administrative Templates ~ 107
Terminal Services ~ 107
Network Configuration Recommendations ~ 110

Chapter 14 Internet Connection Firewall Configuration ~ 111

Recommended Usage ~ 111
Features ~ 111
Stateful packet inspection ~ 111
Protection from port scans ~ 111
Security Logging ~ 112
What it doesn't provide ~ 112
Enabling the ICF ~ 112
Summary ~ 117

Chapter 15 Additional Security Settings ~ 119

Administrator Accounts Recommendations ~ 119
Additional Administrator Accounts ~ 119
Use of Administrator Accounts and the RunAs Command ~ 120
Shared Resource Permissions ~ 120
Setting Share Permissions ~ 121
Share Security Recommendations ~ 121
Deleting POSIX Registry Keys ~ 122
Additional Group Policy Settings ~ 122
Disabling Remote Assistance/Desktop ~ 122
Network Initialization ~ 123
Disabling Media Autoplay ~ 124
Blocking NetBIOS at the Network Perimeter ~ 124

Chapter 16 Modifications for Windows XP in a Windows NT Domain ~ 125

Lack of GroupPolicy ~ 125
NTLM and LanManager Settings ~ 125
Strong Session Key ~ 125
Autoenrollment ~ 126

Appendix A Example Logon Banner ~ 127
Appendix B References ~ 128