42
Domain member: Digitally encrypt secure channel data (when possible)
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Enabled Enabled Enabled Enabled
The
Domain member: Digitally encrypt secure channel data (when possible)
security option setting
determines whether a domain member may attempt to negotiate encryption for all secure channel
traffic that it initiates. Enabling this setting causes the domain member to request encryption of all
secure channel traffic. Disabling this setting prevents the domain member from negotiating secure
channel encryption. Therefore, this setting is configured to
Enabled
in all three environments defined
in this guide.
Domain member: Digitally sign secure channel data (when possible)
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Enabled Enabled Enabled Enabled
The
Domain member: Digitally sign secure channel data (when possible)
security option setting
determines whether a domain member may attempt to negotiate signing for all secure channel traffic
that it initiates. Signing protects the traffic from being modified by anyone who captures the data en
route. This setting is configured to
Enabled
in all three environments defined in this guide.
Domain member: Disable machine account password changes
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Disabled Disabled Disabled Disabled
The
Domain member: Disable machine account password changes security
option setting determines
whether a domain member may periodically change its computer account password. Enabling this
setting prevents the domain member from changing its computer account password. Disabling this
setting allows the domain member to change its computer account password as specified by the
Domain Member: Maximum age for machine account password
setting, which by default is every
30days. Computers that are no longer able to automatically change their account passwords are in
risk of an attacker determining the password for the system’s domain account. Therefore, set this
countermeasure to
Disabled
across the three environments defined in this guide.
Domain member: Maximum machine account password age
Member Server Default
Legacy Client
Enterprise Client
High Security Client
30 days
30 days
30 days
30 days
The
Domain member: Maximum machine account password age
security option setting determines the
maximum allowable age for a computer account password. This setting also applies to computers
running Windows 2000, but it is not available through the Security Configuration Manager tools on
these computers. By default, the domain members automatically change their domain passwords
every 30 days. Increasing this interval significantly, or setting it to 0 so that the computers no longer
change their passwords, gives an attacker more time to undertake a brute force password guessing
attack against one of the computer accounts. Therefore, this setting is configured to the
30 days
in all
three environments defined in this guide.
