Guide to the Secure Configuration and Administration of Microsoft Exchange 2000

UNCLASSIFIED I33 -003 -2005 Guide to the Secure Configuration and Administration of Microsoft Exchange 2000 Systems and Network Attack Center (SNAC) Author: Trent Pits enbarger Updated: 15 Dec. 2004 Version 1.3a [email protected] UNCLASSIFIED UNCLASSIFIED This Page Intentionally Left Blank ii UNCLASSIFIED UNCLASSIFIED Warnings Do not attempt to implement any of the settings in this guide without first testing in a non -operational environment. This document is only a guide containing recommended security settings. It is not meant to replace well -structured policy or sound judgment . Furthermore this guide does not address site -specific configuration issues. Care must be taken when implementing this guide to address local operational and policy concerns. The security changes described in this document only apply to Microsoft Window s 2000 systems and should not be applied to any other Windows 2000 versions or operating systems. This document contains possible recommended settings for the system Registry. Windows 2000 system operation can be severely impaired or disabled with incorrec t changes or accidental deletions when using a Registry editor (Regedt32.exe or Regedit.exe ) to change the system configuration. There is no “undo” command for deletions within the Registry. Registry editor prompts user to confirm the deletions if “Confi rm on Delete” is selected from the options menu. When user deletes a key, the message does not include the name of the key being deleted. Check selection carefully before proceeding. SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCL UDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE EXPRESSLY DISCLAIMED. IN NO EVENT SHALL THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAM AGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE O R OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. This is a living document and revisions will be constant; the change control area will state modifications. Se e Microsoft’s web page for the latest changes or modifications to the Windows 2000 operating system and applications. UNCLASSIFIED iii UNCLASSIFIED This Page Intentionally Left Blank iv UNCLASSIFIED UNCLASSIFIED Acknowledgements The foundation of this document is based on Exchange security guidance developed by the Mitre Corporation under contract to the NSA. Some parts of this document were drawn from Microsoft copyright materials with their permission. Our thanks. Acknowledgements UNCLASSIFIED v UNCLASSIFIED Trademark Information Trademark Information Microsoft, MS -DOS, Windows, Win dows 2000, Exchange 5.5, Exchange 5.0, Exchange 2000, Outlook 2002, Outlook 2000, and IIS are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and other countries. All other names are registered trademarks or trademarks of their respective companies. vi UNCLASSIFIED UNCLASSIFIED Table of Contents Warnings ................................ ................................ ................................ ................................ ..................... iii Acknowledgements ................................ ................................ ................................ ................................ ..... v Trademark Information ................................ ................................ ................................ .............................. vi Table of Contents ................................ ................................ ................................ ................................ ...... vii Table Contents of Table of Figures ................................ ................................ ................................ ................................ ........ xiii Table of Tables ................................ ................................ ................................ ................................ ........... xv Introduction ................................ ................................ ................................ ................................ .................. 1 Getting the Most from this Guide ................................ ................................ ................................ ............... 1 Commonly Used Names ................................ ................................ ................................ ............................ 2 About the Guide to Securing Configuration and Administration of Microsoft Exchange 2000 Server ....... 2 An Important Note About Operating System Security ................................ ................................ ............... 3 Chapter 1 ................................ ................................ ................................ ................................ ...................... 5 Exchange 2000 Installation ................................ ................................ ................................ ......................... 5 Preparing for Installation ................................ ................................ ................................ ............................ 5 Administrative Rights and Prep Utilities ................................ ................................ .............................. 5 Installation Directory ................................ ................................ ................................ ............................ 6 Installation ................................ ................................ ................................ ................................ .................. 6 Post Installation ................................ ................................ ................................ ................................ .......... 8 Service Packs and Hot Fixes ................................ ................................ ................................ .............. 8 Administrative and Routing Group Display ................................ ................................ ......................... 8 OS Guideline Compatibility ................................ ................................ ................................ ................. 8 Shared Directory Permissions ................................ ................................ ................................ ............. 9 Important Security Points ................................ ................................ ................................ ........................... 9 Chapter 2 ................................ ................................ ................................ ................................ .................... 11 Outlook 2002 S ecurity ................................ ................................ ................................ ............................... 11 Security For Outlook 2002 ................................ ................................ ................................ ....................... 11 Outlook 2002 Installation ................................ ................................ ................................ ......................... 12 Outlook 2002 Configuration Setup ................................ ................................ ................................ .......... 13 Outlook Folders ................................ ................................ ................................ ................................ ........ 15 Outlook Folder Permissions ................................ ................................ ................................ .............. 16 Outlook E -mail Security ................................ ................................ ................................ ........................... 19 Attachment Security ................................ ................................ ................................ .......................... 19 Macro Security ................................ ................................ ................................ ................................ .. 21 Secure Messages ................................ ................................ ................................ ............................. 22 Script Protection ................................ ................................ ................................ ................................ 24 Read as Plain Text ................................ ................................ ................................ ............................ 28 Respecting Least Privilege ................................ ................................ ................................ ...................... 28 UNCLASSIFIED vii UNCLASSIFIED Outlook Security Administrative Package ................................ ................................ ............................... 28 Trus ted Code Control ................................ ................................ ................................ ....................... 29 Table Contents of Outlook Security Settings Customization ................................ ................................ ......................... 29 Deployment of Customized Security Settings ................................ ................................ .................. 35 Administrative Control of Outlook Security Settings ...............................

Load more