In the last few years, security has become a hot-button issue for IT organizations of all sizes. Accordingly, many of the security features that were either optional or suspect in Windows 2000 have become solid, effective fixtures in Windows Server 2003-making it the most secure operating system Microsoft has ever produced. That is, if you know how to configure it properly.
The Windows Server 2003 Security Cookbook wants to make sure that you do know how. Picking up right where its predecessor, the Windows Server Cookbook, left off, this desktop companion is focused solely on Windows Server security. It teaches you how to perform important security tasks in the Windows Server 2003 OS using specific and adaptable recipes. Each recipe features a brief description of the problem, a step-by-step solution, and then a discussion of the technology at work. Whenever possible, the authors even tell you where to look for further information on a recipe.
The book is written in a highly modular format, with each chapter devoted to one or more technologies that Windows Server 2003 provides. This approach allows you to look up a task or scenario that you want to accomplish, find that page, and read that particular recipe only. Topics include:
System preparation and administration
Protecting the computer at the TCP/IP level
Applying security options to Active Directory
Improving security on domain controllers
Securing DHCP controllers
Encrypting and signing network traffic using IPSec
Patch management
If you're an intermediate or advanced system administrator who wants to feel secure when deploying Windows Server 2003 and its related services, then you don't want to be without the Windows Server 2003 Security Cookbook.
Chapter 1 Getting Started
What Is Security?
Approach to the Book
Where to Find the Tools
Group Policy Notes
Programming Notes
Replaceable Text
Reporting Security Issues to Microsoft
Where to Find More Information
Chapter 2 System Preparation and Administration
Introduction
Creating a Reference Installation
Renaming the Domain Administrator Account
Renaming the Local Administrator Accounts
Disabling the Local Administrator Accounts
Renaming the Guest Account
Logging in as a Non-Administrator
Configuring Internet Explorer Enhanced Security Configuration
Preventing Automatic Installation of New Hardware Drivers
Protecting Against Modified Device Drivers
Encrypting the SAM
Locking the Console
Enabling Screensaver Locking
Chapter 3 TCP/IP
Introduction
Displaying the Status of TCP Ports
Disabling NetBIOS over TCP/IP
Disabling File and Printer Sharing for MicrosoftNetworks
Enabling SYN Flood Protection
Disabling Source Routing
Disabling Router Discovery
Configuring TCP/IP Filtering
Enabling and Configuring Windows Firewall
Chapter 4 Encrypting File System
Introduction
Enabling EFS Without a Recovery Agent
Configuring a Recovery Agent
Configuring Server-Based EFS
Encrypting a File
Encrypting a Folder
Enabling EFS Context Menus
Viewing Users and Recovery Agents
Moving or Copying an Encrypted File or Folder
Changing Encryption Algorithms
Encrypting Offline Files
Sharing Encrypted Files
Backing Up EFS Keys
Using a Recovery Agent
Removing Unused Data
Chapter 5 Active Directory
Introduction
Enabling SSL/TLS
Encrypting LDAP Traffic with SSL or TLS; Digital Signing
Using the Delegation of Control Wizard
Customizing the Delegation of Control Wizard
Using the Default ACL for an Objectclass
Enabling List Object Access Mode
Modifying the ACL on Administrator Accounts
Viewing and Purging Your Kerberos Tickets
Resetting the Directory Service Restore ModeAdministrator Password
Implementing Role-Based Access Control
Displaying Delegated Rights
Removing Delegated Rights
Chapter 6 Group Policy
Introduction
Creating a GPO
Copying a GPO
Deleting a GPO
Modifying the Settings of a GPO
Creating a GPO Link to an OU
Blocking Inheritance of GPOs on an OU
Forcing a GPO Application
Applying a Security Filter to a GPO
Refreshing GPO Settings on a Computer
Configuring the Group Policy Refresh Interval
Installing Applications with a GPO
Assigning Logon/Logoff and Startup/ShutdownScripts in a GPO
Configuring Password Policies
Configuring Account Lockout Policies
Configuring Kerberos Policies
Configuring User Rights Assignment
Configuring Security Options
Configuring Time Synchronization Settings
Using Restricted Groups
Configuring Service Parameters
Configuring Registry Permissions
Configuring File Permissions
Chapter 7 Security Templates
Introduction
Using Default Security Templates
Creating a Security Template
Changing Account Policies
Changing Local Policies
Changing Event Log Settings
Making Group Membership Changes
Disabling Unwanted System Services
Modifying Registry Permissions
Modifying Filesystem Permissions
Exporting Security Templates
Importing Security Templates
Verifying Template Application
Analyzing a Security Configuration
Testing Template Compatibility
Chapter 8 Domain Controllers
Introduction
Disabling LM Hash Storage
Removing Stored LM Hashes
Requiring NTLM Authentication
Using Syskey to Thwart Offline Attacks
Signing LDAP Communications
Hardening Domain Controllers with SecurityTemplates
Chapter 9 User and Computer Accounts
Introduction
Enabling and Disabling a User
Finding Disabled Users
Unlocking a User
Troubleshooting Account Lockout Problems
Viewing and Modifying the Account Lockout andPassword Policies
Setting a User's Account to Expire
Setting a User's Password
Forcing a User Password Change at Next Logon
Preventing a User's Password from Expiring
Setting a User's Account Options
Finding a User's Last Logon Time
Restricting a User's Logon Hours and Workstations
Resetting a Computer Account
Finding Inactive or Unused Computer Accounts
Trusting a Computer Account for Delegation
Chapter 10 Rights and Permissions
Introduction
Using Standard File Permissions
Using Special File Permissions
Determining File Permission Inheritance
Using Deny Permission
Determining Effective Permissions
Determining File Ownership
Modifying File Ownership
Restoring Default Permissions
Hardening Registry Permissions
Restricting Remote Access to the Registry
Chapter 11 Dynamic Host Configuration Protocol
Introduction
Authorizing a DHCP Server
Detecting Rogue DHCP Servers
Restricting DHCP Administrators
Disabling NetBIOS over TCP/IP Name Resolution
Enabling Dynamic DNS Updates from the DHCP Server
Running DHCP Server on a Domain Controller
Chapter 12 Domain Name System
Introduction
Securing DNS Using the Separate NamespacesApproach
Securing DNS Using the Split-Brain Approach
Restricting DNS Administration Using theDNSAdmins Group
Hiding Your Internal IP Addressing Scheme
Blocking Unwanted DNS Traffic Through aFirewall
Restricting DNS Traffic Through a Firewall UsingForwarders
Preventing DoS Attacks by Disabling Recursion
Hardening DNS by Converting Standard Zones to Active Directory Integrated
Protecting DNS Zones by Requiring Only SecureDynamic Updates
Hardening DNS Clients by Requiring Them to UseSecure Dynamic Updates
Protecting DNS Zones by Disabling DynamicUpdates
Hardening DNS Clients by Preventing Them fromAttempting Dynamic Updates
Preventing Unauthorized Zone Transfers
Restricting Zone Transfers to Legitimate DNS Servers
Preventing Cache Pollution on DNS Servers
Monitoring Suspicious DNS Requests UsingDebug Logging
Securing Resource Records When Usingthe DnsUpdateProxy Group
Preventing DNS Session Sniffing and Hijacking
Chapter 13 File and Print Servers
Introduction
Creating a Hidden File Share
Deleting a File Share
Securing Shared Folders and Files
Preventing Shared File Caching
Determining Access Levels for a File Share
Listing All File Shares
Restricting Printing Permissions
Hardening the Print Spooler
Moving the Print Spool Folder
Disabling Internet Printing
Removing Internet Printing
Chapter 14 IPsec
Introduction
Using a Default IPsec Policy
Creating an IPsec Policy
Creating a Blocking Rule
Creating a Permit Rule
Configuring IPsec Boot Mode
Configuring Authentication Methods
Configuring Connection Types
Configuring Key Exchange
Configuring Session Cryptography
Configuring IP Filter Lists
Configuring IP Filter Actions
Configuring Security Methods
Activating an IPsec Rule
Deactivating an IPsec Rule
Assigning and Unassigning IPsec Policies
Viewing IPsec Statistics with System Monitor
Verifying IPsec Traffic
Using IPsec Monitor to Verify IPsec
Troubleshooting IPsec Connections
Chapter 15 Internet Information Services
Introduction
Configuring Listening Port
Removing Unused Components
Configuring HTTP Authentication
Configuring FTP Authentication
Changing the User Context for AnonymousAccess
Disabling Anonymous Access
Restricting Client Access by ACL
Restricting Client Access by IP Address or DNSName
Installing Server Certificates
Enabling Secure Sockets Layer
Enabling Client Certificate Authentication
Requiring Client Certificate Authentication
Configuring Trusted Certification Authorities
Configuring One-to-One Client Certificate Mapping
Configuring Many-to-One Client CertificateMapping
Chapter 16 RRAS and IAS
Introduction
Configuring the Routing and Remote Access Server
Allowing Authentication Protocols
Requiring Smart Card Authentication
Using Preshared Keys
Configuring RRAS to Use IAS
Installing Internet Authentication Service
Configuring IAS Auditing
Configuring Local IAS Logging
Configuring SQL IAS Logging
Creating a Remote Access Policy
Configuring Connection Time
Chapter 17 Terminal Services and Remote Desktop
Introduction
Choosing a Security Mode
Configuring Session Encryption
Limiting Client Sessions
Requiring a Password for Connection
Securing RPC Administration Traffic
Allowing Silent Session Monitoring
Monitoring Sessions
Enabling Remote Desktop
Configuring Access to Remote Desktop
Chapter 18 Public Key Infrastructure and Certificates
Introduction
Installing an Offline Root CA
Installing an Enterprise Subordinate CA
Installing a Standalone Subordinate CA
Publishing a CRL from an Online CA
Publishing a CRL from an Offline CA
Restricting Access to the CA
Auditing CA Operations
Configuring Certificate Templates
Authorizing the CA to Issue Certificates
Archiving Private Keys
Sending Enrollment Notifications via Email
Requesting Certificates Automatically
Approving and Denying Certificate Requests
Retrieving Issued Certificates
Renewing Certificates
Revoking Certificates
Configuring a Trusted Certificate
Identifying Local Certificates and Private Keys
Backing Up Certificates and Private Keys
Restoring Certificates and Private Keys
Chapter 19 Auditing
Introduction
Auditing Account Logon Events
Auditing Account Management Events
Auditing Directory Service Events
Auditing File Access
Auditing File Share Configuration Events
Auditing Web Server Access
Auditing Policy Change Events
Auditing Privilege Use Events
Auditing Process Tracking Events
Auditing System Events
Shutting Down Windows When Unable to LogEvents
Chapter 20 Event Logs
Introduction
Viewing Events
Setting the Maximum Size of an Event Log
Setting the Event Log Retention Policy
Clearing the Events in an Event Log
Restricting Access to an Event Log
Searching the Event Logs on Multiple Servers
Archiving an Event Log
Finding More Information About an Event
Triggering an Action when an Event Occurs
Consolidating Event Logs
Chapter 21 Patch Management
Introduction
Installing a Root Update Server
Installing a Subordinate Update Server
Installing a Nonstoring Update Server
Installing an Update Server on a NondedicatedServer
Configuring Computers to Use the InternalUpdate Server
Mike Danseglio is a program manager in the Security Solutions group at Microsoft Corporation, and has worked in the areas of security and technology for the last decade. He holds several technical certifications including MCSE and CISSP. Mike's work includes developing and teaching extensive security training on topics such as cryptography, security technology, and attacks and countermeasures. Among his recent projects are writing security documentation for Windows XP and the Windows Server 2003 family, as well as working on a host of white papers and articles. Mike also works on security feature development for Microsoft Windows.
Robbie Allen is a Technical Leader at Cisco Systems where he has been involved in the deployment of Active Directory, DNS, DHCP, and several Network Management solutions. He enjoys working on Unix and Windows, and his favorite programming language is Perl. Robbie was named a Windows Server MVP in 2004 and 2005 for his contributions to the Windows community and publication of several popular O'Reilly books. Robbie is currently studying at MIT in the System Design and Management program.
Comments about oreilly Windows Server 2003 Security Cookbook:
'Windows Server 2003 Security Cookbook' by Mike Danseglio is a great resource for any and all Windows 2003 IT administrators. Written in traditional O'Reilly uber fashion, this is a great desk reference that is easy to recommend.
