Windows 2003 SP1 Member Server in ASU Active Directory WNUG/CCC February 2, 2006 Sharon Bushart CLAS Information Technology

Agenda  Discussion  Share knowledge / experience  Tools / Utilities  Resources  Presentation will be posted on WNUG web page

Goals  Best Practices documents W2K3 SP1 Best Practices v2.doc W2K3 SP1 Best Practices v2.doc  FAQs  Tip sheets  Checklists

CLAS IT Behavioral Sciences Computing 2 Schools with another in Fall Schools with another in Fall Departments, 5 Units/Centers 3 Departments, 5 Units/Centers 14 Buildings 14 Buildings 1200 client systems 1200 client systems 20 servers 20 servers

Preparation  System is NOT on network  Register IP Address & DNS name  License product key  Download service pack, hot fixes, etc  Hardware drivers  Antivirus software plus latest sdat  Documentation

Local Admin Accounts  Create new account(s)  Add new account(s) to local admin group  Logon with new admin account  Rename default admin and guest accounts  Disable default admin account  Do not include AD groups in local admin group – use Run As instead

Install …  Hardware drivers  Anti-Virus software with latest sdat  Tools, Utilities  Windows Automatic update Notify but do not automatically download or install Notify but do not automatically download or install  Drive Management

Firewall  System is still NOT on network  Firewall should be ON  Open only the ports that are necessary  Port information Service Overview & Network Port Requirements for the Windows Server System (10/31/05)Service Overview & Network Port Requirements for the Windows Server System (10/31/05) Macs Macs

Firewall

Firewall (continued)

Add Port Information Logging Options

Firewall – Default Services

Firewall – Add Service

Firewall – Service & Ports DescriptionPort AD Authentication (TCP) 1025 DNS (TCP & UDP) 53 Kerberos (TCP & UDP) 88 LDAP (TCP & UDP) 389 File Sharing (TCP & UDP) 445 Network Time Protocol (TCP & UDP) 123 NetBIOS (TCP) 139

Firewall – Service & Ports Example

TCP/IP

TCP/IP - DNS Add DNS Servers Append DNS suffixes Uncheck Register …

TCP/IP - WINS Add WINS Servers Depends on clients

Default Share Permission

Revised Share Permission

NTFS Permissions

Security Policy  Include access rights, security options, account lockout, etc…  Two methods for changing Local Security Policy Local Security Policy Administrative Tools | Local Security PolicyAdministrative Tools | Local Security Policy Group Policy Object Editor Group Policy Object Editor

Security Policy – Audit Audit Policy DescriptionDefaultMemSvr Account logon eventsSS/F Account managementNAS/F Directory service accessNA Logon eventsSS/F Object accessNA Policy changeNAS/F Privilege useNA Process trackingNA System eventsNAS/F

Security Policy – Audit  Microsoft Articles on Audit Policy: = Security Event Descriptions = Security Event Descriptions = Service Account Logon Events = Service Account Logon Events  Events & Error Message Center GPO Editor: Computer Configurations\Windows Settings\Security Settings\Local Policies\Audit Policy

Security Policy – User Rights  Access this computer from Network Remove Everyone Remove Everyone Add appropriate OU groups Add appropriate OU groups Remove Authenticated Users Remove Authenticated Users  Allow log on locally Administrators only Administrators only GPO Editor: Computer Configurations\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Security Policy – Security Options  Do Not Display Last User Name Disabled  Enabled Disabled  Enabled  Message Text for Users attempting to log on WARNING! You are accessing a computer protected by federal and state law and ASU policies. By using this system you agree to comply with these laws and policies, including ACD 125 (Computer, Internet and Electronic Communications Policy) and you consent to system monitoring for law enforcement, administrative and other purposes. Unauthorized use of this computer system may subject you to criminal prosecution, civil liability and University sanctions. WARNING! You are accessing a computer protected by federal and state law and ASU policies. By using this system you agree to comply with these laws and policies, including ACD 125 (Computer, Internet and Electronic Communications Policy) and you consent to system monitoring for law enforcement, administrative and other purposes. Unauthorized use of this computer system may subject you to criminal prosecution, civil liability and University sanctions.

Security Policy – Security Options (continued)  Do not allow anonymous enumeration of SAM accounts/shares Disabled  Enabled Disabled  Enabled  LAN Manager authentication level Send LM & LTLM – use NTLMv2 session if negotiated Send LM & LTLM – use NTLMv2 session if negotiated GPO Editor: Computer Configurations\Windows Settings\Security Settings\Local Policies\Security Rights

Security Test  Microsoft Baseline Analyzer  Security Configuration Wizard Included with SP1 Included with SP1 Configures server based on role Configures server based on role  Review output & adjust if necessary  Connect server to network  Windows Update  Anti-Virus Update

Microsoft Tools  Administration Tool Pack 2-3e00-4d5e-9b01-cf2bf256912d1033.mspx 2-3e00-4d5e-9b01-cf2bf256912d1033.mspx 2-3e00-4d5e-9b01-cf2bf256912d1033.mspx 2-3e00-4d5e-9b01-cf2bf256912d1033.mspx  Group Policy Management Console  Port Reporter  PortQry

Microsoft Documents  Windows Server 2003 Security Guide /w2003hg/sgch00.mspx /w2003hg/sgch00.mspx /w2003hg/sgch00.mspx /w2003hg/sgch00.mspx  Threats & Countermeasures: Security Settings in Windows Server 2003 & Windows XP h00.mspx h00.mspx h00.mspx h00.mspx  Security Risk Management Guide secrisk/default.mspx secrisk/default.mspx secrisk/default.mspx secrisk/default.mspx  Other documents Administrator Accounts Security Planning Guide Administrator Accounts Security Planning Guide Services & Service Accounts Security Services & Service Accounts Security

Reference Material  Microsoft TechNet  Center for Internet Security  SANS  Trial and Error Documentation Documentation

Contact Information Sharon Bushart