UNCLASSIFIED Windows NT Security Guidelines Considerations & Guidelines for Securely Configuring Windows NT in Multiple Environments A study for NSA Research by Trusted Systems Services [email protected] http://www.trustedsystems.com 217-344-0996 3 June 1999 Author: Steve Sutton Trusted Systems Services Sponsor: Scott Cothrell National Security Agency ©1998 Trusted Systems Services, Inc. All rights reserved. The U.S. Government has unlimited usage license under 1995 DFARS 252.227-7013. This document was prepared wholly under contract to the National Security Agency (MDA904-97-C-0336) and has been approved for public release. © 1998 TSS, Inc. UNCLASSIFIED UNCLASSIFIED 3 June 1999 ii NSA Windows NT Security Guidelines UNCLASSIFIED © 1998 TSS, Inc. UNCLASSIFIED Table of Contents New in this Release (3 June 1999) ............................................................................................. vii 1. Introduction ...................................................................................................................1 Scope & Intent...............................................................................................................................1 Level 1 & Level 2..........................................................................................................................2 Structure ........................................................................................................................................2 Notes & Terminology....................................................................................................................3 AdvancedChecker Software ..........................................................................................................3 Acknowledgments .........................................................................................................................4 2. Overview of the Guidelines...........................................................................................5 3. Installation .....................................................................................................................9 Guidelines......................................................................................................................................9 Disable Unused Hardware..................................................................................................... 9 Physical Protection ................................................................................................................ 9 Using Other Operating Systems to Install Windows NT....................................................... 9 Booting from Alternative Media ........................................................................................... 9 Installing Alternative Operating Systems.............................................................................. 9 NTFS File System Format................................................................................................... 10 Removing the POSIX and OS/2 Subsystems ...................................................................... 10 Do Not “Copy Install” ......................................................................................................... 10 Notes............................................................................................................................................11 Booting Alternative Operating Systems .............................................................................. 11 Physical Protection .............................................................................................................. 11 Multiple Copies of Windows NT on One Computer........................................................... 12 4. Domains & Basic Access Restrictions........................................................................13 Guidelines....................................................................................................................................13 Notes............................................................................................................................................14 Domains, Trusts & the Scope of Accounts.......................................................................... 14 Accounts & Network Authentication .................................................................................. 15 Domain Models ................................................................................................................... 16 Logon Rights in Multidomain Environments ...................................................................... 16 5. Administrative Structure............................................................................................19 Guidelines....................................................................................................................................19 The “Administrator” Account ............................................................................................. 19 Full Administrators.............................................................................................................. 20 Domain Operators & Power Users ...................................................................................... 21 Administrative Practices...................................................................................................... 22 Notes............................................................................................................................................23 Shared Administrative Accounts ......................................................................................... 23 The PASSPROP Utility....................................................................................................... 23 Renaming the Administrator Account................................................................................. 23 6. General Policies ...........................................................................................................25 Guidelines & Notes .....................................................................................................................25 Raw Devices & Non-NTFS Volume ACLs......................................................................... 25 Restricting Access to Floppies and CDROMs..................................................................... 25 Unauthenticated (“Anonymous”) Remote Access to the Registry ...................................... 26 NSA Windows NT Security Guidelines iii 3 June 1999 © 1998 TSS, Inc. UNCLASSIFIED UNCLASSIFIED Restricting Who can Access the Registry Remotely ........................................................... 26 Enabling the Registry Editors.............................................................................................. 27 ProtectionMode ................................................................................................................... 28 Unauthenticated Event Log Viewing................................................................................... 29 Print Driver Installation ....................................................................................................... 29 Screen Saver Locking.......................................................................................................... 29 Protecting Hashed Passwords & SYSKEY.......................................................................... 30 Password Notification Feature............................................................................................. 31 User & Share Names Available to Unauthenticated Users.................................................. 32 Hiding the Last User Logon ................................................................................................ 32 Shutting Down the System .................................................................................................. 32 Miscellaneous Hot-Fixes ..................................................................................................... 33 The C2CONFIG Tool.......................................................................................................... 33 7. File System & Registry ACL Settings ....................................................................... 35 Guidelines................................................................................................................................... 36 Notes........................................................................................................................................... 36 File System ACL Settings ................................................................................................... 36 Registry ACL Settings......................................................................................................... 43 Installing & Testing New Applications ............................................................................... 47 A Modest Change to Tighten WINNT ACL's ..................................................................... 47 Limiting Installers in the WINNT & Registry ACL Settings .............................................. 48 Tightening Service Pack ACL’s .......................................................................................... 49 Software Installation that “Moves” New Items into Protected Directories ......................... 49 8. Application & User Home Directories .....................................................................