Microsoft Solutions for Security Group (MSS) Would Like to Acknowledge and Thank the Team That Produced the Windows XP Security Guide
Total Page：16
File Type：pdf, Size：1020Kb
Microsoft Solutions for Security Windows XP Security Guide v2.0 M Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, e – mail addresses, logos, people, places and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e – mail address, logo, person, place or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. © 2004 Microsoft Corporation. All rights reserved. Microsoft and Active Directory, ActiveX, Authenticode, Jscript, Media Player, MSDN, MS – DOS, MSN Messenger, NetMeeting, Outlook Express, Windows, Windows XP Professional, Windows NT 4.0, Windows 2000, Windows Server 2003, Visual Basic, Visual Basic Scripting Edition are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. Acknowledgments The Microsoft Solutions for Security group (MSS) would like to acknowledge and thank the team that produced the Windows XP Security Guide. The following people were either directly responsible or made a substantial contribution to the writing, development, and testing of this solution. Authors Reviewers Mike Danseglio Eric Cameron José Maldonado Duane Crider Bob Partridge Steve Dodson Tony Quinn Adam Edwards Mike Kaczmarek Content Contributors Chrissy Lewis Kurt Dillard Mike Lonergan Jesper Johansson Joe Porter Testers Brian Schafer Gaurav Singh Bora Ben Smith Paresh Gujar Josh Vincent Ashish Java Jeff Williams Mehul Mediwala Contributors Editors Ignacio Avellaneda Reid Bannecker Ganesh Balakrishnan John Cobb Derick Campbell Kelly McMahon Sean Finnegan Jon Tobey Joanne Kennedy Steve Wacker Geoff Morris Program Manager Jeff Newfeld Chase Carpenter Rob Oikawa Bomani Siwatu Bill Reid Reviewers Bryan Chee Rich Benack Graham Whiteley Shelly Bird Jay Zhang At the request of Microsoft, the Center for Internet Security (CIS) and the United States Department of Commerce National Institute of Standards and Technology (NIST) participated in the final review of this Microsoft security guide and provided comments that were incorporated into the published version. Table of Contents Chapter 1: Introduction to the Windows XP Security Guide 1 Overview ...................................................................................................................................... 1 Executive Summary ..................................................................................................................... 2 Who Should Read This Guide ..................................................................................................... 3 Get Secure Stay Secure .............................................................................................................. 4 Get Secure ............................................................................................................................... 4 Stay Secure.............................................................................................................................. 4 Scope of this Guide...................................................................................................................... 5 Enterprise ................................................................................................................................. 5 High Security ............................................................................................................................ 5 Stand – Alone Environment.......................................................................................................5 Chapter Overview ........................................................................................................................ 6 Chapter 1: Introduction to the Windows XP Security Guide .................................................... 6 Chapter 2: Configuring the Active Directory Domain Infrastructure......................................... 6 Chapter 3: Security Settings for Windows XP Clients.............................................................. 6 Chapter 4: Administrative Templates for Windows XP ............................................................ 6 Chapter 5: Securing Stand – Alone Windows XP Clients ......................................................... 7 Chapter 6: Software Restriction Policies for Windows XP Clients........................................... 7 Chapter 7: Conclusion.............................................................................................................. 7 Appendix A: Additional Guidance for Windows XP Service Pack 2......................................... 7 Download Content ....................................................................................................................... 8 Skills and Readiness.................................................................................................................... 9 Requirements............................................................................................................................. 10 Style Conventions ...................................................................................................................... 11 Summary.................................................................................................................................... 12 More Information .................................................................................................................... 12 Chapter 2: Configuring the Active Directory Domain Infrastructure 13 Overview .................................................................................................................................... 13 OU Design to Support Security Management............................................................................ 14 Department OU ...................................................................................................................... 15 GPO Design to Support Security Management......................................................................... 16 Security Templates................................................................................................................. 18 Administrative Templates ....................................................................................................... 19 Domain Level Group Policy .......................................................................................................19 Password Policy......................................................................................................................... 20 Enforce password history....................................................................................................... 20 Maximum password age ........................................................................................................ 20 Minimum password age ......................................................................................................... 21 Minimum password length...................................................................................................... 22 Password must meet complexity requirements...................................................................... 22 Store password using reversible encryption for all users in the domain................................ 23 Preventing Users from Changing Passwords Except When Required .................................. 23 Account Lockout Policy.............................................................................................................. 25 Account lockout duration........................................................................................................26 Account lockout threshold ...................................................................................................... 26 Reset account lockout counter after....................................................................................... 27 User Rights Assignment ............................................................................................................ 28 Add workstations to domain ................................................................................................... 28 Security Settings ........................................................................................................................ 29 Microsoft network server: Disconnect clients when logon hours expire ................................ 29 Network Access: Allow anonymous SID/NAME translation ................................................... 30 Network