Installation of Windows-NT Workstation at PC40 [Security Enhancements].

Summary
 
This note describes how to increase the security of the prototype Windows-NT 4.0 Workstation installation on PC40.
 

CONTENTS

0. Preface

1. Registry
1.1 Legal Notice
1.2 ACLs
1.3 Access to drives and printers

2. File System ACLs
2.1 System Files and Directories
2.2 General Directories
2.3 Common Application Directories
2.4 User Home Directories

3. Rights Policy
3.1 Access this computer from the network
3.2 Bypass traverse cheking
3.3 Debug Programs
3.4 Log on Locally
3.5 Shut Down the system

4. Auditing
4.1 Audit Policy
4.2 Log Files

5. BIOS and Physical Security
5.1 Limit Access to BIOS
5.2 Physical Security

 

0. Preface

The security measures as described below, are taken from the book "Window NT Security Guide" by Stephen A. Sutton. 1997 Addison-Wesley Developer Press, ISBN 0-201-41969-6.
 

1. Registry

1.1 Legal Notice

Add Legal Notice at logon via Edit | String... .

1.2 ACLs

On each of the following keys, give Everyone "Read" permission.

1.3 Access to drives and printers

Limit access to drives and redirection of printers.

2. File System ACLs
 
Except when noted, apply the following changes not only to these directories, but also to all subdirectories and existing files by checking both of these options on the Directory Permissions window. Make the changes in the order shon.

2.1 System Files and Directories

2.2 General Directories 2.3 Common Application Directories

Use the following ACLs for the application directories:

Use the following ACLs for application directories and files created on behalf of users Now apply the application directory ACLs to the following directories. Set permissions on C:\Program Files\Netscape\Netscape Navigator\Users  Set permissions on ...
C:\Program Files\Netscape\Netscape Navigator\Program\Plugins Set permissions on C:\Program Files\Plus!\Microsoft Internet\cache, history (may need to run Internet Explorer first to create directories.) Relax the following entries for Users ... Change Borland C++ IDE Shortcuts Working on Program Tab to empty. See: 2.4 User Home Directories
 
Optional local user home directories are on drive D:. 3. Rights Policy

Use the User Manager to manage the Right Policy (Policies | User Rights).
When adding useres, select the PC, not the domain (Biophysics).
Check "Show advanced user rights".

3.1 Access this computer from the network
 
Change Everyone to Users.

3.2 Bypass traverse cheking

Enable only for full administrators (and SYSTEM user: not found).

3.3 Debug Programs
 
Remove Administrators

3.4 Log on Locally
 
Remove Everyone and Guests.

3.5 Shut Down the system
 
Remove Everyone.
 

4. Auditing

Select the events to audit and limit the size of the System, Security and Application logs.

4.1 Audit Policy

In User Manager select Policies | Audit... and set the following.

Audit These Events           | Success  Failure  Note
-----------------------------+-----------------------------------------
Logon and Logoff                  V        V
File and Object Access                      
Use of User Rights
User and Group Management         V        V
Security Policy Changes           V        V
Restart, Shutdown and System      V        V
Process Tracking

4.2 Log Files

From Event Viewer select Log | Log Settings... and set the following for System, Security and Application logs.

Maximum Log Size: 512 Kilobytes (default)
(•) Overwrite Events as Needed
( ) Overwrite Events Older than 7 days
( ) Do Not Overwrite Events (Clear Log Manually)
 

5. BIOS and Physical Security

5.1 Limit Access to BIOS

Make shure the PC can only boot from C and that this setting can only be changed by an authorized person.

5.2 Physical Security

Attach a special cable to the PC's case and secure the PC with a lock, e.g. to a table.