Hardening Windows W2K Server This document is intended as a starting checklist to harden Windows 2000 Server and IIS for security vulnerabilities. This checklist is designed for those that are extremely familiar with Windows and IIS, as explanations for the checklist actions are not included. It is strongly recommend that you visit the Microsoft Security and Privacy page, at http://www.microsoft.com/security/default.asp, for specific information about each step and the reason behind each action. Install 2000 Server operating system Install only options required Specify machine is part of a Workgroup and not a domain Install latest OS service patches as recommended at
http://v4.windowsupdate.microsoft.com/en/default.asp Install all needed "critical updates" Install all needed "Windows 2000 updates" Install latest Office updates as recommended at
http://office.microsoft.com/productupdates/ Run Microsoft Baseline Security Analyzer (MBSA) that can be found at
http://www.microsoft.com/technet/treeview/?url=/technet/security/
tools/Tools/MBSAhome.asp. Select the applicable type of server configuration.
Note: This product will automatically set some of the setting below. Rename the "Everyone" Group to a different name Rename the "Administrator" account to a different name (do not use "admin") Run syskey.exe, select Encryption Enabled, then select Ok Registry Changes HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogin\LegalNoticeCaption
change value to include your company name or site owner HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogin\LegalNoticeText change
value to "Unauthorized Use Prohibited by 18, U.S.C." Run drwtsn32 uncheck all options except Append to "Existing Log File" Delete HKLM\System\CurrentControlSet\Control\Session Managaer\SubSystems\OS2 Delete HKLM\System\CurrentControlSet\Control\Session Managaer\SubSystems\Posix Delete HKLM\System\CurrentControlSet\Control\Session Managaer\SubSystems\Optional Delete HKLM\Software\Microsoft\RPC\ClientProtocols\ncacn_ip_tcp Delete HKLM\Software\Microsoft\RPC\ClientProtocols\ncagd_ip_upd Control Panel Changes Control Panel\System/Advanced\Startup and Recovery Set display list to 10 seconds. Check "Automatic Reboot" Set Write Debugging Information to "none" Control Panel\ Administrative Tools\Local Security Policy\Account Policies\Password Policy\ Enforce password history to 8 Minimum password length to 8 Maximum password age to 30 Control Panel\ Administrative Tools\Local Security Policy\Account Policies\Account Lockout Policy Account lockout duration to 10 minutes Account lockout threshold to 5 Reset account lockout counter to 10 minutes Control Panel\ Administrative Tools\Local Security Policy\Local Policies\Audit Policy Audit account logon events to Success, Failure Audit account management to Success, Failure Audit directory service access to Success, Failure Audit login events to Success, Failure Audit policy change to Success, Failure Audit privilege use to Success, Failure Audit process tracking to Success, Failure Audit system events to Success, Failure Control Panel\ Administrative Tools\Local Security Policy\Local Policies\Security Options Allow System to Be Shut Down Without Having to Login On to Disabled Audit Use of Backup and Restore Privilege to Enabled Clear Virtual Memory Pagefile When System Shuts Down to Enabled Disable CTRL-ALT-DEL Requirements for Login to Disabled Do Not Display Last User Name in Login Screen to Enabled Message Text for Users Attempting to Log On to "Unauthorized use prohibited by 18, U.S.C" Message Title for Users Attempting to Log On to company or site owners name Prevent Users from Installing Printer Drivers to Enabled Recovery Console: Allow Automatic Administrative Login to Disabled Restrict CD-ROM Access to Locally Logged-On User to Enabled Restrict Floppy Access to Locally Logged-On user to Enabled Set Unsigned Driver Installation Behavior to Do not allow (NOTE: May prevent software installs) Unsigned Non-Driver Installation Behavior to Do no allow (NOTE: May prevent software installs) Additional restrictions for anonymous connections to No access without explicit anonymous permissions Control Panel\Network and Dial-up Connections\applicable connections\Properties\General Deselect all components except "Internet Protocol (TCP/IP)" Control Panel\Network and Dial-up Connections\applicable connections\Properties\General\, select Internet Protocol (TCP/IP), select Properties, select Advanced\Wins Disable NetBIOS over TCP/IP Disable LMHOSTS lookup Control Panel\Network and Dial-up Connections\applicable connections\Properties\General\, select Internet Protocol (TCP/IP), select Properties, select Advanced\Options\TCP/IP filtering Disable or filter all TCP, UDP, and IP ports as needed Control Panel\ Administrative Tools\Computer Management\Local Users and Groups\Users Guest account\General Tab\Cannot change password Guest account\General Tab\Password never expires Guest account\General Tab\Account disabled Guest account\Dial-in Tab\Remote Access Permission\Deny access Services Configure the following Windows Services to start automatically: DNS Client Event Log Logical Disk Manager IPSec Policy Agent Plug and Play Protected Storage Remote Registry Service RunAs Security Accounts Manager Task Scheduler Configure the following Windows Services to start manually Application Management ClipBook COM+ Event System Logical Disk Manager Administrative Service Distributed Link Tracking Server Fax Service File Replication Indexing Service Internet Connection Sharing Net Logon Netmeeting Remote Desktop Network Connections Network DDE Network DDE DSDM NT LM Security Support Provider Performance Logs and Alerts Qos RSVP Remote Access Auto Connection Manager Remote Access Connection Manager Remote Procedure Call (RPC) Locator Smart Card Smart Card Helper Unit Power Supply Utility Manager Windows Installer Windows Management Instrumentation Driver Extensions Disable the following Windows Services: DHCP Client Intersite Messaging Kerberos Key Distribution Center Messenger Print Spooler Routing and Remote Access Simple Mail Transport Protocal (SMTP) Telephony Telnet Terminal Services Windows Time General Changes For the Everyone Group that was renamed C Drive: Document and Settings folder rights: Read & Execute, List Folder Contents, Read C Drive: WinNT folder rights: none Web folder: Read & Execute, List Folder Contents, Read Remove all rights for the Everyone group, that was renamed, from following c:\winnt\system32 files arp.exe at.exe cacls.exe cmd.exe command.exe debug.exe edit.com edlin.exe finger.exe ftp.exe ipconfig.exe nbtstat.exe net.exe netstat.exe nslookup.exe ping.exe posix.exe rdisk.exe rcp.exe rexec.exe regedit.exe regedt32.exe route.exe rsh.exe runone.exe syskey.exe tracert.exe telnet.exe xcopy.exe (And any others not needed) IIS Stop Administrative Web Site Stop Default SMTP Virtual Server Stop FTP Site if installed Delete the "iisstart.asp" in the WWWRoot directory Delete the "iissamples" folder under the "inetpub" directory Delete the "iisadmin" folder under the "inetpub" directory Delete the "iishelp", "issadmin" and "iissamples" virtual directory for all current webs. NOTE: These directories should be deleted on any future webs also. Display Properties Set screen saver to "Logon Screen Saver" Set screen saver to 5 minutes Check password protect Install remote control program if desired Disable Guest account Uncheck Internet Locator services if an option Install Firewall software Disable or close all unnecessary ports Be sure to grant access IP access to any machine that will be used to administer the server remotely Install AntiVirus program Enable "start program on Windows startup" option Turn on all activity logs (detection, quarantine, etc) Disable "audible alert" option Check that "how to respond when a virus is found" is set for an automatic solution. (Norton for example uses the a default of "ask me what to do".) Enable scan of "master boot records" Enable scan of "boot records" Scan all inbound file types Web Content Create directory for web content (do not use default web directory) Load content Set directory, and .NET if applicable, permissions Use SiteRecons URL Comments page (http://www.siterecon.com/URLComments.aspx) to verify not inappropriate comments are embedded in your pages. Vulnerability Scan Use a vulnerability scanner or scanning services to verify your site is secure and no vulnerability exist. A web search for the term "vulnerability scanner" will yield numerous companies to select from. NOTE: Other security steps may be required based on you system, architecture, and specific needs! Site and server security requires daily procedures to insure a proper defense. Security patched must be applied upon release, and the system and firewall logs need to be reviewed daily to track activity and intrusion attempts. About the Author Lew Newlin is CTO of Information Solutions, Inc. that operates SiteRecon.com. SiteRecon specializes in security, email monitoring, and web site monitoring for Internet service providers and businesses.