16
after the client’s logon hours have expired. When enabling this setting, the
Network security: Force
logoff when logon hours expire
setting should be enabled
. If the company has configured logon
hours for users, then it makes sense to enable this policy. Otherwise, users who are assumed to be
unable to access network resources outside of their logon hours may actually be able to continue to
use those resources with sessions that were established during allowed hours. If logon hours are not
used, enabling this setting will have no impact. If logon hours are used, then existing user sessions
will be forcibly terminated when their logon hours expire.
Network Access: Allow Anonymous SID/ NAME translation
Domain Member
Default
Legacy Client
Enterprise Client
High Security Client
Not defined
Disabled
Disabled
Disabled
Important: For NAS environments that require anonymous multi-protocol communications to cross
platform systems, this guide recommends setting this security option to Enabled.
The
Network Access: Allow anonymous SID/NAME translation
setting determines if an anonymous
user can request the SID for another user. If this policy is enabled on a domain controller, a user who
knows an administrator’s SID attributes could contact a computer that also has this policy enabled
and use the SID to obtain the administrator’s name. That person could then use the account name to
initiate a password guessing attack. Disabled is the default setting on
member
computers; therefore it
will have no impact on them. However, the default setting for
domain controllers
is Enabled.
Warning
:
Disabling this setting may cause legacy systems to be unable to communicate with
Windows Server 2003 based domains such as:
•
Windows NT 4.0-based Remote Access Service servers.
•
When a Web application on IIS is configured to allow basic authentication and at the same
time has Anonymous access disabled, the built-in Guest user account cannot access the Web
application. Also, if the built-in Guest user account was renamed to another name, the new
name cannot be used to access the Web application.
•
Remote Access Service servers running on Windows 2000-based computers that are located
in Windows NT 3.x domains or Windows NT 4.0 domains.
•
Multi-protocol applications such as Microsoft Services For Unix (SFU) and Microsoft Services
For Netware (SFN) which require anonymous access for client systems may not function.
Network Security: Force Logoff When Logon Hours Expire
Domain Member
Default
Legacy Client
Enterprise Client
High Security Client
Disabled Enabled Enabled Enabled
The
Network Security: Force Logoff when Logon Hours expire
setting determines whether to disconnect
users who are connected to a local computer outside their user account’s valid logon hours. This
setting affects the SMB component. Enabling this policy forcibly disconnects client sessions with the
SMB server when the client’s logon hours expire and the user will be unable to log on to the system
until his or her next scheduled access time. Disabling this policy maintains an established client
session after the client’s logon hours expire. To affect domain accounts, this setting must be defined in
the Default Domain Policy.
