54
system. Users who can access the console could shut the system down. An attacker or misguided user
could connect to the server via Terminal Services and shut it down or restart it without having to
identify him or herself. Therefore, this countermeasure should be set to the default across all three
environments.
Shutdown: Clear virtual memory page file
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Disabled Disabled Disabled Enabled
The
Shutdown: Clear virtual memory page file
security option setting determines whether the virtual
memory pagefile is cleared when the system is shut down. When this setting is enabled, it causes the
system pagefile to be cleared each time that the system shuts down gracefully. If this security setting is
enabled, the hibernation file (hiberfil.sys) is also zeroed out when hibernation is disabled on a
portable computer system. Shutting down and restarting the server will take longer and will be
especially noticeable on servers with large paging files. For these reasons, this setting is configured to
Enabled
in the High Security environment but set to
Disabled
in the Legacy Client and Enterprise
Client environments.
Note:
An attacker who has physical access to the server could bypass this countermeasure by simply
unplugging the server from its power source.
System cryptography: Force strong key protection for user keys stored on the computer
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Not Defined
User is prompted when
the key is first used
User is prompted when
the key is first used
User must enter a
password each time
they use a key
The
System cryptography: Force strong key protection for user keys stored on the computer
security
option setting determines whether users’ private keys, such as their SMIME keys, require a password
to be used. If this policy is configured so that users must provide a password-distinct from their domain
password-every time that they use a key, then even if an attacker takes control of their computer and
determines what their logon password is, accessing locally stored user keys will be more difficult. For
usability requirements in the Legacy Client and Enterprise Client environments, the value for this
setting is configured to the
User is prompted when the key is first used
setting option. To further
secure the environment, in the High Security environment this setting value is configured to
User must
enter a password each time they use a key.
System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Disabled Disabled Disabled Disabled
The
System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing
security
option setting determines whether the Transport Layer Security/Secure Sockets Layer (TL/SS) Security
Provider supports only the TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher suite. Enabling this policy
ensures that computers in the company’s network environment will use the most powerful algorithms
available for digital encryption, hashing, and signing. This will minimize the risk of an unauthorized
user compromising digitally encrypted or signed data. For these reasons, this setting is configured to
Disabled
in the three environments defined in this guide.
System objects: Default owner for objects created by members of the Administrators group
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Administrators group
Object creator
Object creator
Object creator