8
Group Policies are implemented using security templates. These text based *.inf files can be
accessed and applied using the Security Template snap-in found within Microsoft Management
Console (MMC). All computers running Windows 2003 and Windows Storage Server 2003 store
their security templates in the %SystemRoot%\security\template folder.
Administrators can implement NSA compliant security templates by downloading the Microsoft
Windows Server 2003 Security Guide from
http://www.microsoft.com/downloads/details.aspx?FamilyId=8A2643C1-0685-4D89-B655-
521EA6C7B4DB&displaylang=en
and extracting the security templates found within the guide.
Warning:
Although the security templates within the Microsoft guide does increase network security,
some applicational and operating system functionality may be lost due to its implementation. It is
essential
to thoroughly test these templates before deploying them in a production environment. Back
up each domain controller and server before applying any new security settings. Ensure the system
state is included in the backup to enable registry settings or Active Directory objects to be restored.
Complete the following tasks to import the Microsoft Domain Policy security template into the domain
server systems:
1. In
Active Directory Users and Computers,
right-click the
Domain,
and then select
Properties.
2. On the
Group Policy
tab, click
New
to add a new GPO.
3. Depending upon the company’s network infrastructure, type
Legacy Client - Domain Policy,
Enterprise Client - Domain Policy,
or
High Security Client - Domain Policy
and then press
Enter.
4. Right-click on the new domain policy and then select
No Override
.
5. Select on the new domain policy and then click
Edit.
6. In the Group Policy window, click
Computer Configuration\Windows Settings.
Right-click
Security Settings,
and then select
Import Policy.
7. In the
Import Policy From
dialog box, navigate to
\Security Guide\Job Aids,
and then double-
click on the corresponding
Legacy Client - Domain.inf, Enterprise Client - Domain.inf,
or
High
Security Client - Domain.inf.
8. Close the
Group Policy
that has been modified.
9. Close the
Domain Properties
window.
10. Force replication between the domain controllers so that all have the policy applied to them
by typing the following command text within a DOS command prompt window:
gpupdate /Force.
For Windows 2000 Active Directory domains:
Administrators should use
the
secedit.exe
/refreshpolicy
command-line from the DOS prompt instead to force domain policy replication.
11. Verify in the
Event Log
that the Group Policy downloaded successfully and that the server can
communicate with the other domain controllers in the domain.
Warning:
When creating the company’s domain policy, ensure that the
No Override
option is
enabled to enforce this policy throughout the domain. This is the only Group Policy in which the
No
Override
option must be enabled. Administrators should not enable this option in any of the other
group policies specified within this guide nor should they modify the Windows Server 2003 Default
Domain Policy. To ensure that this new policy has precedence over the default policy, position it to
have the highest priority among the GPO links.