Windows 2008 Domain Controller Security Technical Implementation Guide

This check verifies that Windows is configured to limit IPSec exemptions.

This check verifies whether User Interface Accessibility programs can automatically disable the secure desktop for elevation prompts for a standard user.

This check verifies that the system is configured to prevent users from mapping local COM ports and redirecting data from the Terminal Server to local COM ports.

This check verifies that the system is configured to prevent users from redirecting Plug and Play devices to the Terminal Services session.

This check verifies that the system is configured to allow only the default client printer to be redirected in the Terminal Services session.

Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting “High Level” will ensure encryption of Terminal Services sessions in both directions.

Inappropriate granting of user rights can provide system, administrative, and other high level capabilities not required by the normal user.

Determines what should happen when the smart card for a logged-on user is removed from the smart card reader. The options are: - No Action - Lock Workstation - Force Logoff

This policy controls the ability of members of the local Server Operators group to schedule AT jobs. If disabled, only administrators can schedule jobs that use AT commands. Unlike Scheduled Tasks which require you to specify the credential under which the task will run, AT jobs run under the authority of whatever account the AT service runs (SYSTEM by default). Non administrators who can schedule AT commands, thus have a means to elevate their privileges. Although this setting is disabled, Server Operators will still be able to schedule jobs using Task Scheduler.

This setting determines the maximum amount of time (in minutes) that a granted session ticket can be used to access a particular service. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket used to authenticate the connection expires during the connection.

This setting determines the period of time (in days) during which a user's Ticket Granting Ticket (TGT) may be renewed. This security configuration limits the amount of time an attacker has to crack the TGT and gain access.

This is a Category 1 finding because it could give unauthorized individuals access to the Registry. It controls which registry paths are accessible from a remote computer.

This is a Category 1 finding because it allows anonymous logon users (null session connections) to list all account names and enumerate all shared resources, thus providing a map of potential points to attack the system.

This is a Category 1 finding because users and user groups that are assigned this right can bypass all security protective mechanisms that apply to all users, including administrators. Accounts with this right should have passwords with the maximum length and be kept in a locked container accessible only by the IAO and his designated backup. Some applications require this right to function. Any exception needs to be documented with the IAO.

The built-in administrator account is a well known account. Renaming the account to an unidentified name improves the protection of this account and the system.

Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication. Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment. Check with the Vendor of the SMB server to see if there is a way to support encrypted password authentication.

By default, the print spooler allows any user to add and to delete printer drivers on the local system. This capability should be restricted to authorized personnel.

Disabling the Ctrl+Alt+Del security attention sequence can compromise system security. Because only Windows responds to the Ctrl+Alt+Del security sequence, you can be assured that any passwords you enter following that sequence are sent only to Windows. If you eliminate the sequence requirement, malicious programs can request and receive your Windows password. Disabling this sequence also suppresses a custom logon banner.

As a part of Windows security, computer account passwords are changed automatically. Enabling this policy to disable automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for your system. If this policy is disabled, a new password for the computer account will be generated every week.

This check verifies that UAC has not been disabled.

This setting, which is located under the Temporary Folders section of the Terminal Services configuration option, controls the deletion of the temporary folders when the session is terminated. Temporary folders should always be deleted after a session is over to prevent hard disk clutter and potential leakage of information.

Removable hard drives can be formatted and ejected by others who are not members of the Administrators Group, if they are not properly configured. Formatting and ejecting removable NTFS media should only be done by administrators.

Windows system maintains a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. If this policy is enabled, the default DACL is stronger, allowing non-admin users to read shared objects, but not modify shared objects that they did not create.

This setting controls whether or not solicited remote assistance is allowed from this computer. Solicited assistance is help that is specifically requested by the user. This is a Category 1 finding because it may allow unauthorized parties access to the resources on the computer.

This setting prevents the Windows Messenger client from being run. Instant Messaging clients must be in compliance of with the Instant Messaging STIG. Windows Messenger should not be active on Windows unless the instant messaging system is a Managed Enterprise Service for unclassified data for which the DAA has approved.

This setting controls the maximum password age that a machine account may have. This setting should be set to no more than 30 days, ensuring the machine changes its password monthly.

This setting controls the storage of authentication credentials or .NET passports on the local system. Such credentials should never be stored on the local machine as that may lead to account compromise.

Windows includes two network-sharing security models - Classic and Guest only. With the classic model, local accounts must be password protected; otherwise, anyone can use guest user accounts to access shared system resources.

This setting controls the signing requirements for LDAP clients. This setting should be set to Negotiate signing or Require signing depending on the environment and type of LDAP server in use.

Microsoft has implemented a variety of security support providers for use with RPC sessions. In a homogenous Windows environment, all of the options should be enabled and testing should be performed in a heterogeneous environment to determine the maximum-security level that provides reliable functionality.

When disabled, forces ICMP to be routed via shortest path first.

Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.

Allowing more than several seconds makes the computer vulnerable to a potential attack from someone walking up to the console to attempt to log onto the system before the lock takes effect.

Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.

Information systems not protected with strong password schemes including passwords of minimum length provide the opportunity for anyone to crack the password thus gaining access to the system and causing the device, information, or the local network to be compromised or a denial of service.

The user name of the last user to log onto a system will not be displayed. This eliminates half of the Userid/Password equation that an unauthorized person would need to log on.

This policy setting stops the system from generating audit events for every file backed up or restored which could fill the Security log in Windows.

This check verifies that the system is configured to make the options to publish to the web unavailable from File and Folder Tasks in Windows folders.

This check verifies that the system is configured to prevent Windows Messenger from collecting anonymous information about how the Windows Messenger software and service is used.

This check verifies that the system is configured to prevent the client computer’s ability to print over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.

This check verifies that the system is configured to prevent Windows from searching Windows Update for device drivers when no local drivers for a device are present.

This check verifies the Network Bridge can not be installed and configured.

This check verifies that unhandled file associations will not use the Microsoft Web service to find an application.

This check verifies that the codecs will not be automatically downloaded for Windows Movie Maker.

This check verifies that movies can not be sent to a video hosting provider on the web.

This check verifies that the shell protocol is run in protected mode. (This allows applications to only open limited folders.)

This check verifies that users are prevented from changing installation options.

This check verifies that users are not presented with Privacy and Installation options on first use of Windows Media Player.

This is a category 1 finding because the ability to set access permissions and audit critical directories and files is only available by using the NTFS file system. The capability to assign access permissions to file objects is a DOD policy requirement. The FAT file system only provides the capability to make files read-only and hidden. The capability to change these attributes is not restricted to any users. An unauthorized individual could boot the machine from a floppy disk and gain full and unrecorded access to file data.

Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.

Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic should be encrypted.

Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media starts immediately. By default, Autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive), and on network drives. If you enable this policy, you can also disable Autoplay on all drives.

This setting ensures that the system uses algorithms that are FIPS compliant for encryption, hashing, and signing. FIPS compliant algorithms meet specific standards established by the U.S. Government and should be the algorithms used for all OS encryption functions.

This is a Category 1 finding because of the potential for gaining unauthorized system access. Pipes are internal system communications processes. They are identified internally by ID numbers that vary between systems. To make access to these processes easier, these pipes are given names that do not vary between systems. When this setting is disabled, Network shares can be accessed by any network user. This could lead to the exposure or corruption of sensitive data.

This check verifies whether the built-in Administrator account runs in Admin Approval Mode.

This check verifies whether Windows only allows applications installed in a secure location, such as the Program Files or the Windows\System32 folders, on the file system to run with elevated privileges.

This check verifies that non UAC compliant applications will run in virtualized file and registry entries allowing them to run.

The McAfee Agent is the client side distributed component of McAfee ePolicy Orchestrator (McAfee ePO) which provides a secure communication channel between the ePO server and managed point products.

This check verifies that the Responder network protocol driver is disabled.

This check verifies that users will not be prompted to search Windows Updated for device drivers.

This check verifies that untrusted content is not rendered for online assistance.

This check verifies that SpyNet membership is disabled.

This check verifies that Windows Mail will not check newsgroups for Communities support.

This check verifies that Windows Media Digital Rights Management will be prevented from accessing the internet.

This registry key will prevent the autorun.inf from executing commands.

Displaying the shutdown button may allow individuals to shut down a system anonymously. Only authenticated users should be allowed to shut down the system. Preventing display of this button in the logon dialog box, ensures that individuals who shut down the system are authorized and tracked in the systems Security event log.

If this setting is enabled, then Group Policy settings are not refreshed while a user is currently logged on. This could lead to instances when a user does not have the latest changes to a policy applied and is therefore operating in an insecure context.

This check verifies that the “Order Prints Online” task is not available in Windows Explorer.

The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to "0". The smaller this value is, the less effective the account lockout feature will be in protecting the local system.

The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Further, scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.

A system faces an increased vulnerability threat if the built-in guest account is not disabled. This account is a known account that exists on all Windows systems and cannot be deleted. This account is initialized during the installation of the operating system with no password assigned. This account is a member of the Everyone user group and has all the rights and permissions associated with that group, which could subsequently provide access to system resources to anonymous users.

Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy should never be enabled.

This setting controls the ability to undock the system without having to log on. Since the removal of a computer should be controlled, users should have to log on before undocking the computer to ensure that they have the appropriate rights to undock the system. In addition to software security settings, physical security should be in place to prevent unauthorized removal of computers.

Audit records may be lost if the security log becomes full. When the audit log reaches a given percent full, an audit event is written to the security log. An event is recorded as a success audit under the category of System. This option may be especially useful if the audit logs are set to be cleared manually.

Configuring this setting so that users must provide a password (distinct from their domain password) every time they use a key makes it more difficult for an attacker to access locally stored user keys, even if the attacker takes control of the user's computer and determines their logon password.

Software restriction policies help to protect users and computers from executing unauthorized code such as viruses and Trojans horses.

Permissions on the Winlogon registry key must only allow privileged accounts to change registry values. If standard users have this capability there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.

Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.

Unsigned network traffic is susceptible to man-in-the-middle attacks where an intruder captures packets between the server and the client and modifies them before forwarding them to the client. In the case of an LDAP server, this means that an attacker can cause a client to make decisions based on false records from the LDAP directory. You can lower the risk of an attacker pulling this off in a corporate network by implementing strong physical security measures to protect the network infrastructure. Furthermore, implementing Internet Protocol security (IPSec) authentication header mode (AH), which performs mutual authentication and packet integrity for Internet Protocol (IP) traffic, can make all types of man-in-the-middle attacks extremely difficult.

To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root Certificate Authorities (CAs). The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs.

Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have this capability there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.

Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. The "Deny log on locally" right defines accounts that are prevented from logging on interactively. The Guests group must be assigned this right to prevent unauthenticated access.

Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. The "Deny log on as a service" right defines accounts that are denied log on as a service. Incorrect configurations could prevent services from starting and result in a DoS.

Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. The "Deny Access from the Network" right defines the accounts that are prevented from logging on from the network. The Guests group must be assigned this right to prevent unauthenticated access.

To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.

Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.

Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.

Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.

SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.