Threats and Countermeasures Guide: Security Settings in Windows Server 2008 and Windows Vista

Applies To: Windows Server 2008

Note

To download a copy of this document, see https://go.microsoft.com/fwlink/?LinkId=148532.

This guide is a reference to security settings that provide countermeasures for specific threats against current versions of the Windows® operating systems.

This guide is a companion for two other publications that are available from Microsoft:

• Windows Server® 2008 Security Guide (https://go.microsoft.com/fwlink/?LinkID=105788)

• Windows Vista® Security Guide (https://go.microsoft.com/fwlink/?LinkId=74027)

Many of the countermeasures that are described in this guide are not intended for specific computer roles in the companion guides, or in some cases for any roles at all. These countermeasures help ensure compatibility, usability, manageability, availability, or performance.

Generally, as security increases, functionality decreases, and vice versa. However, there are exceptions, and some security countermeasures actually help to improve functionality.

Each section begins with a brief explanation of what is in the section, followed by a list of subsection headings, each of which corresponds to a setting or group of settings. Each subsection includes a brief explanation of what the countermeasure does and the following three additional subsections:

• Vulnerability. Explains how an attacker might exploit a feature or its configuration.

• Countermeasure. Explains how to implement the countermeasure.

• Potential impact. Explains the possible negative consequences of countermeasure implementation.

For example, the section "Domain Level Account Policies" begins with the following subsections:

Account Policies

• Enforce password history

  • Vulnerability

  • Countermeasure

  • Potential impact

• Maximum password age

  • Vulnerability

  • Countermeasure

  • Potential impact

This pattern is repeated throughout this guide. Settings that are closely related are presented in a single subsection. For example, in the "Security Options" section, four related settings are all placed into the same subsection as follows:

Microsoft network client and server: Digitally sign communications

• Microsoft Network Client: Digitally Sign Communications (Always)

• Microsoft Network Server: Digitally Sign Communications (Always)

• Microsoft Network Client: Digitally Sign Communications (If Server Agrees)

• Microsoft Network Server: Digitally Sign Communications (If Client Agrees)

This guide focuses on those Group Policy settings that are considered security settings; those that are intended to help organizations manage their environments are not documented. This guide examines only the settings and features in Windows Server 2008 and Windows Vista that can help organizations secure their enterprises against specific threats. Settings and features that were added in service packs after the release of Windows Vista and Windows Server 2008, or functionalities that may have been added by software released after those service packs, may not be discussed in this guide. Also, management features and those security features that are not configurable by administrators are not described in this guide.

The information that is provided within this guide should help you and members of your organization understand the countermeasures that are available in current versions of the Windows operating system. For prescriptive guidance about what settings to use for specific scenarios, refer to the two companion guides:

• Windows Server 2008 Security Guide (https://go.microsoft.com/fwlink/?LinkId=105788)

• Windows Vista Security Guide (https://go.microsoft.com/fwlink/?LinkId=74027)

Section Overviews

This guide consists of seven sections that provide a reference to the settings that you should consider while planning the security policy for your organization.

Account Policies	This section discusses the Group Policy settings that are applied at the domain level: password policies, account lockout policies, and Kerberos authentication protocol policies.
Audit Policy	This section discusses the use of audit policies to monitor and enforce your security measures. It describes the various settings and provides examples of how audit information is modified when the settings are changed.
User Rights	This section discusses the various logon rights and privileges that are provided by the Windows operating systems and provides guidance about which accounts should be assigned these rights.
Security Options	This section provides guidance about security settings for digital data signatures, Administrator and Guest account names, drive access, driver installation behavior, and logon prompts.
Event Log	This section provides guidance about how to configure the settings that relate to the various event logs on computers running Windows Server 2008 or Windows Vista.
System Services	Windows Vista and Windows Server 2008 include a variety of system services. Many of these services are configured to run by default, but others are not present unless you install specific components. This section describes the various services included with the operating systems so that you can best decide which ones to leave enabled and which ones can be safely disabled.
Software Restriction Policies	This section provides a brief overview of the Software Restriction Policy feature available in Windows Vista and Windows Server 2008. It provides links to additional resources about how to design and use policy settings to control which applications can be used in your organization.
Additional System Countermeasures	This section describes a number of additional security measures that may need to be applied to your computers. However, these countermeasures cannot be easily applied through Group Policy or other automated means. These countermeasures include securing accounts on member servers, NTFS settings, data and application segmentation, SNMP community name settings, disabling NetBIOS bindings, Terminal Services configuration, Dr. Watson, and Internet Protocol security (IPsec) policies. A short overview on Windows Firewall is also provided along with a pointer to more extensive guidance on Windows Firewall that you should review if your organizational security policy includes Windows Firewall settings.
Additional Registry Entries	This section provides information about additional registry entries that should be considered in configuring your overall security policy.
Additional Resources	This section provides links to additional information sources about Windows security topics from Microsoft that you may find useful.