Securing Windows Server 2003 tasks
Cisco TMS Secure Server Configuration Guide 13.0
Page 28 of 34
5.
Fill in AutoShareServer for Name and 0 for Value data.
Screen saver
Make sure that the screensaver is password protected in order to prevent internal threads from taking
over the server.
To enable the password for the screen saver, right-click the desktop and go to Properties > Screen
Saver tab. Select a screensaver and checkmark ‘On resume, password protect’.
Avoid cpu-intensive screensavers such as the OpenGL screensavers and use instead the ’Logon
Screen Saver’. Adjust the wait time of the screen saver to a sensible value.
Set the grace period for the screen saver to prompt for a password to be 0 by adding a registry key.
To do this, edit the following key in the registry setting in the Registry Editor:
1.
Under HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon double-click ScreenSaverGracePeriod
2.
Set Value data to
0
.
Disable dump file creation
If the system crashes, a dump file can provide a hacker with sensitive information. To disable the
dump file creation:
1.
Go to Windows Start > Control Panel > System. Under the Advanced tab.
2.
Under Startup and Recovery, click the Settings button.
3.
Select ‘(none)’ under Write Debugging Information.
Miscellaneous registry changes
To edit settings used to secure the server, edit the registry on the Windows Server by opening a
command window.
1.
Go to Windows Start > Run.
2.
Type
cmd
3.
Type
regedt32
Note ‘regedt32’ should be used to make the following changes to the registry and not ‘regedit’.
Protect the registry from anonymous access
To restrict remote access to the registry go into the following hive.
Under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg
•
Click the Security toolbar and select Permissions
•
Remove all except Administrators who should have Full Control
Disable 8.3 file format compatibility
Filename compatibility for 8.3 file format is on by default. Turn this off.
Under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
Modify
•
Value Name: NtfsDisable8dot3NameCreation
•
Value Type: REG_DWORD
•
Value: 1
