Securing Windows Server 2003 tasks
Cisco TMS Secure Server Configuration Guide 13.0
Page 24 of 34
Table 8 Recommended security options
Policy
Security Setting
Accounts: Administrator account status
Enabled
Accounts: Guest account status
Disabled
Accounts: Limit local account use of blank
passwords to console logon only
Enabled
Accounts: Rename administrator account
(Rename to a unique name and delete
description)
Accounts: Rename guest account
(Rename to a unique name)
Audit: Audit the access of global system objects
Disabled
Audit: Audit the use of Backup and Restore
privilege
Disabled
Audit: Shut down system immediately if unable
to log security audits
Enabled
Note: This setting creates some overhead.
DCOM: Machine Access Restrictions in Security
Descriptor Definition Language
Not Defined
DCOM: Machine Launch Restrictions in Security
Descriptor Definition Language
Not Defined
Devices: Allow undock without having to log on
Disabled
Devices: Allowed to format and eject removable
media
Administrators
Devices: Prevent users from installing printer
drivers
Enabled
Devices: Restrict CD-ROM access to locally
logged-on user only
Disabled
Devices: Restrict floppy access to locally
logged-on user only
Disabled
Devices: Unsigned driver installation behavior
Warn but allow installation
Domain controller: Allow server operators to
schedule tasks
Not defined
Domain controller: LDAP server signing
requirements
Not defined
Domain controller: Refuse machine account
password changes
Not defined
Domain member: Digitally encrypt or sign
secure channel data (always)
Enabled
Domain member: Digitally encrypt secure
channel data (when possible)
Enabled
Domain member: Digitally sign secure channel
data (when possible)
Enabled
Domain member: Disable machine account
password changes
Disabled
Domain member: Maximum machine account
password age
30 Days
