UNCLASSIFIED NOTE: The ACL settings for the WINNT directory described in the Guidelines are available as Super CACLS scripts, free in the "Super CACLS Example Script Library" on the Trusted Systems Services Download Page: http://www.TrustedSystems.com/fm_Signup.htm (last name case sensitive) © 1998 TSS, Inc. UNCLASSIFIED UNCLASSIFIED Windows NT Security Guidelines Considerations & Guidelines for Securely Configuring Windows NT in Multiple Environments A study for NSA Research by Trusted Systems Services [email protected] http://www.trustedsystems.com 217-344-0996 18 March 1998 Author: Steve Sutton Trusted Systems Services Sponsor: Scott Cothrell National Security Agency ©1998 Trusted Systems Services, Inc. All rights reserved. The U.S. Government has unlimited usage license under 1995 DFARS 252.227-7013. This document was prepared wholly under contract to the National Security Agency (MDA904-97-C-0336) and has been approved for public release. © 1998 TSS, Inc. UNCLASSIFIED UNCLASSIFIED 18 Mar 98 ii NSA Windows NT Security Guidelines UNCLASSIFIED © 1998 TSS, Inc. UNCLASSIFIED Table of Contents 1. Introduction .............................................................................................................. 1 Scope & Intent .........................................................................................................................1 Level 1 & Level 2 ....................................................................................................................2 Structure ..................................................................................................................................2 Notes & Terminology...............................................................................................................3 Checker Software.....................................................................................................................3 Acknowledgments....................................................................................................................5 2. Overview of the Guidelines....................................................................................... 7 3. Installation ...............................................................................................................11 Guidelines..............................................................................................................................11 Disable Unused Hardware .............................................................................................. 11 Physical Protection......................................................................................................... 11 Using Other Operating Systems to Install Windows NT .................................................. 11 Booting from Alternative Media ..................................................................................... 11 Installing Alternative Operating Systems ........................................................................ 11 NTFS File System Format .............................................................................................. 12 Removing the POSIX and OS/2 Subsystems ................................................................... 12 Do Not “Copy Install”.................................................................................................... 12 Notes .....................................................................................................................................13 Booting Alternative Operating Systems .......................................................................... 13 Physical Protection......................................................................................................... 13 Multiple Copies of Windows NT on One Computer........................................................ 14 4. Domains & Basic Access Restrictions .....................................................................15 Guidelines..............................................................................................................................15 Notes .....................................................................................................................................16 Domains, Trusts & the Scope of Accounts ...................................................................... 16 Accounts & Network Authentication .............................................................................. 17 Domain Models.............................................................................................................. 18 Logon Rights in Multidomain Environments................................................................... 18 5. Administrative Structure.........................................................................................21 Guidelines..............................................................................................................................21 The “Administrator” Account......................................................................................... 21 Full Administrators ........................................................................................................ 22 Domain Operators & Power Users .................................................................................. 23 Administrative Practices................................................................................................. 24 Notes .....................................................................................................................................25 Shared Administrative Accounts..................................................................................... 25 The PASSPROP Utility .................................................................................................. 25 Renaming the Administrator Account ............................................................................. 25 6. General Policies .......................................................................................................27 Guidelines & Notes................................................................................................................27 Raw Devices & Non-NTFS Volume ACLs ..................................................................... 27 Restricting Access to Floppies and CDROMs ................................................................. 27 Preventing Unauthenticated & Controlling Remote Registry Access................................ 28 Enabling the Registry Editors ......................................................................................... 29 NSA Windows NT Security Guidelines iii 18 Mar 98 © 1998 TSS, Inc. UNCLASSIFIED UNCLASSIFIED ProtectionMode...............................................................................................................29 Unauthenticated Event Log Viewing ...............................................................................30 Print Driver Installation...................................................................................................30 Screen Saver Locking......................................................................................................31 Protecting Hashed Passwords & SYSKEY.......................................................................31 Password Notification Feature.........................................................................................32 User & Share Names Available to Unauthenticated Users ................................................33 Hiding the Last User Logon.............................................................................................33 Shutting Down the System ..............................................................................................34 Miscellaneous Hot-Fixes .................................................................................................34 The C2CONFIG Tool......................................................................................................35 7. File System & Registry ACL Settings..................................................................... 37 Guidelines .............................................................................................................................38 Notes .....................................................................................................................................38 File System ACL Settings ...............................................................................................38 Registry ACL Settings.....................................................................................................45 Installing & Testing New Applications ............................................................................49 8. Application & User Home Directories.................................................................... 51 Guidelines .............................................................................................................................51 Application Directories ...................................................................................................51 User Home Directories....................................................................................................52 9. User Accounts & Groups........................................................................................ 55 Guidelines .............................................................................................................................55