114
The
Domain member: Digitally encrypt or sign secure channel data (always)
security option setting
determines whether all secure channel traffic initiated by the domain member must be signed or
encrypted. If a system is set to always encrypt or sign secure channel data, then it cannot establish a
secure channel with a domain controller that is not capable of signing or encrypting all secure
channel traffic, because all secure channel data is signed and encrypted. This security option to
Disabled
in the Legacy Client and Enterprise Client environments and it is configured to
Enabled
in the
High Security environment.
.
Microsoft network client: Digitally sign communications (always)
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Disabled Disabled Enabled Enabled
Important:
In mixed environments with legacy clients, set this option to
Disabled
as these clients will
not be able to authenticate or gain access to domain controllers. However, this setting should be
Enabled within Windows 2000 or later environments. The Enterprise Client and High Security
environments defined in this guide only contain systems running Windows 2000 or later, which
support signing digital communications. Therefore, to increase communications security between
systems in this environment, this setting is configured to
Enabled
in the Enterprise Client and High
Security environments. This setting must be set to
Disabled
for HP NAS server systems within multi-
protocol network environments involving NFS, AFTP, or NCP.
The
Microsoft network client: Digitally sign communications (always)
security option setting determines
whether packet signing is required by the SMB client component. Enabling this setting prevents the
Microsoft network client from communicating with a Microsoft network server unless that server agrees
to perform SMB packet signing.
Microsoft network server: Digitally sign communications (always)
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Disabled Disabled Enabled Enabled
Important:
Administrators within multi-protocol heterogeneous environments should set this setting to
Disabled
or at least verify that their 3
rd
party application (i.e. Server for NFS, Services for UNIX,
Services for Netware, etc…) have packet signing support.
The
Microsoft network server: Digitally sign communications (always)
security option setting
determines whether packet signing is required by the SMB server component before further
communication with an SMB client is permitted. Windows 2000 Server, Windows 2000 Professional,
Windows Server 2003, and Windows XP Professional include versions of SMB that support mutual
authentication, which closes session hijacking attacks and supports message authentication (thus
preventing man-in-the-middle attacks). SMB signing provides this authentication by placing a digital
signature into each SMB packet, which is then verified by both the client and the server. When
computers are configured to ignore all unsigned SMB communications, legacy applications and
operating systems will be unable to connect. Completely disabling all SMB signing leaves the
computers vulnerable to session hijacking attacks.
Network access: Let Everyone permissions apply to anonymous users
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Disabled Disabled Disabled Disabled
Important:
Domains with this setting will be unable to establish or maintain trusts with Windows NT
4.0 domains or domain controllers. This setting should be set to Enabled for all hp NAS server
systems requiring anonymous user access within multi-protocol network environments.
