Introducing Windows 2000 Security: Features and Management

84-02-01 DATA SECURITY MANAGEMENT INTRODUCING WINDOWS 2000 SECURITY: FEATURES AND MANAGEMENT David Goldman INSIDE Computer Management Console; Local Security Settings Console; File System Enhancements; Encrypting File System; Disk Quotas; ACL Editor; Policy Enhancements; Password Complexity Requirements; Reversible Encryption; Audit Policy; New User Rights; Security Options The first major difference that administrators will notice when they click Start->Programs->Administrative Tools is that the familiar set of tools (User Manager for Domains, Server Manager, Event Viewer, Disk Administrator, etc.) has been replaced by two Microsoft Management Console (MMC) snap-ins (Exhibit 1). The MMC is historically known as the interface for ad- ministering Internet Information Server 4.0, and is now the central location for all enterprisewide management of Windows 2000 objects. In an environment without Active Directory Services, the Computer Management and Local Security Settings consoles provide access to all the configuration options previously available through the tools above, and many that required still other tools or resource kit PAYOFF IDEA utilities. In an environment with Ac- Although Windows 2000 has been out for several months now, many companies are employing a tive Directory Services, the following wait-and-see approach while others have placed functions are managed through the the software in the confines of engineering. As a Active Directory Users and Comput- result, many systems administrators and opera- ers and Active Directory Domains tions support personnel may not have had an op- portunity to explore the new operating system and Trusts MMC consoles. Further, and obtain a solid understanding of its enhance- within an environment with Active ments. This article explores two major areas of Directory Services, the concepts of Windows 2000: the new security features and group policies and delegation are in- the new toolset for management of those features. It is assumed that the reader has a solid un- troduced. These concepts are beyond derstanding of the tools and security features the scope of this article. available in Windows NT 4.0. Auerbach Publications © 2000 CRC Press LLC EXHIBIT 1 — Microsoft Management Console (MMC) A brief feature overview of the Computer Management console dem- onstrates the benefits of the consolidated management toolset. These features include: 1. Local users and groups. All security in the Windows environment re- volves around access controls assigned to users and groups. Within this section, users and groups can be created, edited, and otherwise managed. Accounts can be disabled and unlocked, passwords reset, and profiles set. 2. Disk management. Without utilizing the appropriate file system, access controls cannot be placed on files and directories. Through the use of this option, hard drives can be formatted with NTFS. Further, the concept of disk quotas has been introduced and settings can be implemented on a per-user basis. 3. Shared folders. Once there is a defined set of users and an environment to support access controls, those users must be granted access to resources. When creating or managing shares through this interface, both the share-level permissions and the NTFS-level permissions for the shared resource can be set. 4. Event viewer. Once resources are secured, monitoring ensues. In addition to the three logs familiar to past users — System, Application, Auerbach Publications © 2000 CRC Press LLC and Security — new logs have been introduced. These new logs include DNS Server, File Replication Service, and Directory Service. Both log settings and event viewing occur here. 5. Performance logs and alerts. While event logs require someone to physically view the logs, this feature supports defining performance objects, performance counters, and object instances, and setting thresholds for system services that can initiate actions when reached. 6. System information. When alerts are raised or event logs entries de- note problems, this option, formerly referred to as Windows NT Di- agnostics, provides detailed system information from device interrupts to environment variables, and is often invaluable for re- solving resource conflicts. 7. Device manager. If resource conflicts or other hardware problems are discovered, the device manager allows the manipulation of DMA, IRQ, and other hardware settings to resolve these issues. While this console provides access to many other functions, the benefits of consolidation can already be seen. Similarly, the Local Security Settings console organizes those compo- nents of Windows 2000 security that must be carefully configured to en- sure system confidentiality, integrity, and availability. These features include: 1. Password policy. In addition to the familiar password settings, two new options are introduced, “Passwords must meet complexity requirements” and “Store passwords using reversible encryption for all users in the domain.” These new options are discussed later. 2. Account lockout. Users of the old resource kit utility passprop.exe will be pleased to learn the administrator account is now required to adhere to the account lockout policy for network logons. 3. Audit policy. Some audit categories have changed their names and two new ones have been added, “Account logon events” and “Direc- tory service access,” which are discussed later. 4. User rights assignment. The number of user rights has increased by seven, to 34. These seven rights include “Deny” for the four logon types (from the network, as a batch job, as a service, and locally). New rights include “Enable computer and user accounts to be trusted for delegation,” “Remove computer from docking station,” and “Syn- chronize directory service data,” all to be discussed later. 5. Security options. The oft-daunting task of modifying the registry is somewhat eased through this new interface that provides access to old and new security settings and which are detailed later. Public key policies for the Encrypting File System and IPSec policies are also configured here, creating a powerful security management tool. Auerbach Publications © 2000 CRC Press LLC With the concept of centralized management covered, one might ask, “What new features can one manage?” These features can be grouped into two categories: file system enhancements and policy enhancements. The first group includes the Encrypting File System, disk quotas, and access controls lists (ACLs), while the second includes password policies, audit policies, user rights, and the security options of the security policy console. To introduce the first group, there is the Encrypting File System (EFS) that encrypts files on NTFS partitions using the DES algorithm and a user’s private key. The operating system automatically decrypts the files when loaded, provided the correct user is the one accessing the files. The only users who can decrypt or read an encrypted file are the user who encrypted the file and any specified recovery agents. As alluded to earlier, recovery agents can be managed through the Local Security Set- tings console. A file can be encrypted simply by right-clicking on it in Ex- plorer, selecting Properties, clicking Advanced, and checking the box labeled “Encrypt contents to secure data.” Another new feature supported by the file system is disk quotas. While quotas have been a feature of other operating systems, under Win- dows NT 4.0, third-party tools were necessary to manage and restrict disk usage. Quotas are set on a per-group or per-user basis by right-clicking on a drive in Computer Management or Explorer. The first step requires checking the box “Enable quota management” and is a per-drive setting. From there, options including disk space, warning threshold, which quota events to log, and the ability to deny disk space to users who exceed their limit, can all be set. After that, there is the simple matter of assigning quota amounts to the desired user accounts. The next new feature, which also relates to the file system, is the only one not managed through a console. With the release of Service Pack 4 for Windows NT 4.0, Microsoft introduced a new ACL editor and ex- posed the new interface native to Windows 2000. The new ACL editor provides increased functionality and more granularity when assigning access to files and directories. This enhanced model introduces the ability to explicitly deny access to a user or group, to set the inheritance for the object being secured, and, for folders, the ability to apply the ACL to objects at a level never before available (Exhibit 2). The second group of enhancements, the policy enhancements, cov- ers those items previously labeled with the phrase “which are discussed later.” The first of the two new items of the password policy is “Pass- words must meet complexity requirements” and its purpose is fairly ob- vious. This option is akin to implementing the resource kit utility passprop/complex or passfilt.dll on a Windows NT 4.0 Domain Con- troller. This setting requires passwords to be comprised of a variety of mixed-case characters, numerals, and symbols. Auerbach Publications © 2000 CRC Press LLC EXHIBIT 2 — The New ACL Editor The second option, which is far less intuitive, “Store passwords using reversible encryption for all users in the domain,” should only be utilized in instances where users log on from an Apple Macintosh computer or when Shiva Password Authentication Protocol (SPAP) is the primary means of authentication. This selection weakens the stored password and increases the likelihood that it will be cracked if obtained. The two new options of the audit policy are also somewhat obscure. The “account logon events” refers to logon attempts by privileged accounts that log on to the domain controller. These audit events are gen- Auerbach Publications © 2000 CRC Press LLC erated when the Kerberos Key Distribution Center logs on to the domain controller (and by MSV1_0 for Windows NT 4.0-style logons). The “directory service access” audit event is generated when access to objects within the active directory is attempted.

Load more