The Security Configuration Wizard can greatly simplify the hardening of the server.  Once the role for the host is defined, the SCW can help create a system configuration based specifically on that role. It does not completely get rid of the need to make other configuration changes, though. For more information, please see Security Configuration Wizard for Windows Server 2003.

3

There are several methods available to assist you in applying patches in a timely fashion:

Microsoft Update Service

• This Web-based application checks your machine to identify missing patches and allows you to download and install them.
• This service is compatible with Internet Explorer only.

Windows AutoUpdate

ITS offers a Windows Server Update Services Server for campus use using Microsoft's own update servers.

Microsoft Baseline Security Analyzer
This is a free host-based application that is available to download from Microsoft. In addition to detailing missing patches, this tool also performs checks on basic security settings and provides information on remediating any issues found.

4

Configure Automatic Updates from the Automatic Updates control panel

• On servers, you should choose either “Download updates for me, but let me choose when to install them,” or “Notify me but don’t automatically download or install them.”
• ITS offers a Windows Server Update Services Server for campus use using Microsoft's own update servers.

6

Configuring the minimum password length settings is important only if another method of ensuring compliance with university password standards is not in place.

7

Configuring the password complexity setting is important only if another method of ensuring compliance with university password standards is not in place.

8

The university requires the following event log settings instead of those recommended by the CIS Benchmark:

• Maximum application log size—50000 KB
• Maximum security log size—100000 KB
• Maximum system log size—50000 KB

• Prevent local guests group from accessing application log—enabled
• Prevent local guests group from accessing security log—enabled
• Prevent local guests group from accessing system log—enabled

• Retention method for application log—Overwrite events older than 14 days
• Retention method for security log—Overwrite events older that 14 days
• Retention method for system log—Overwrite events older than 14 days
  

These are minimum requirements. The most important log here is the security log. 100 MB is a suggested minimum, but if you have a high-volume service, make the file as large as necessary to make sure at least 14 days of security logs are available. You may increase the number of days that you keep, or you may set the log files to not overwrite events.

16

The text of the university's official warning banner can be found on the ITS Web site. You may add localized information to the banner as long as the university banner is included.

23

Evaluate the services running on your server and disable any that are not necessary. Much more detailed information regarding services is available in the CIS Benchmark document. However, you are not required to disable exactly the same services that the CIS Benchmark recommends. In this particular case, it is just a reference guide.

25

Configure user rights to allow to be as secure as possible. You are not required to make the exact User Rights changes outlined in the CIS Benchmark. In this case, it is just a reference guide for possible User Rights settings. Every attempt should be made to remove Guest, Everyone, and ANONYMOUS LOGON from the user rights lists.

26

If the operating system was installed using FAT format, it may be converted to NTFS using the convert utility. Microsoft has provided instructions for the conversion procedure.

This conversion can not be reversed.

27

IPSec is one method that can limit connections to the server, and it is another standard method by which communication between servers can be encrypted.

IPSec configuration can be managed using the IP Security Policies Snap-In. More information can be found on the Microsoft site.

28

File system permissions: You are not required to make the exact file system permissions changes outlined in the CIS Benchmark. In this case, it is just a reference guide for possible permissions settings.

Proceed extremely carefully, as setting incorrect permissions on system files and folders can render a system unusable.

29

Registry Permissions: You are not required to make the exact registry permissions changes outlined in the CIS Benchmark. In this case, it is just a reference guide for possible permissions settings.

Proceed extremely carefully, as setting incorrect permissions registry entries can render a system unusable.

30

By default, domain members synchronize their time with domain controllers using Microsoft's Windows Time Service. The domain controller should be configured to synchronize its time with an external time source.

ITS Networking operates two stratum 2 NTPv4 (NTP version 4) servers for network time synchronization services for university network administrators.

31

Download and install Symantec AntiVirus from BevoWare. If you are managing many desktops or servers, consider using the Symantec System Center, which is also available through BevoWare.

32

Anti-spyware software is only required to be installed if the server is used to browse Web sites not specifically related to the administration of the server.

ITS provides anti-spyware software for no additional charge. At a minimum, SpyBot Search and Destroy should be installed. We also recommend that a secondary anti-spyware application should be installed such as SpyWare Blaster, EMS Free Surfer, or AdAware be installed. Both SpyWare Blaster and EMS Free Surfer are available from BevoWare.

33

See the ITS Web site for instructions on scheduling daily updates of Symantec AntiVirus.

34

Spyware Blaster—Enabling auto-update functionality requires the purchase of an additional subscription

SpyBot Search and Destroy—Automatic update tasks can be created inside the program itself and are scheduled using the Windows Task Scheduler.

1. In the Spybot Application, click on Mode-->Advanced View.
2. Click Settings on the left hand side of the window.
3. You should now see an option labeled “Scheduler.” Select that option.
4. Adding the task to update automatically is relatively straightforward.
• Click Add to create a task.
• Click Edit to edit the task schedule.
• In the Scheduled Task window that pops up, enter the following In the Run field:

"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /AUTOUPDATE /TASKBARHIDE /AUTOCLOSE

• Click the Schedule tab and choose a time for it to update. The duration of the update is very brief, but it is processor intensive, so consider scheduling it to occur during periods of low usage. The task should be scheduled daily.

35

1. Open the Display Properties control panel.
2. Select the Screen Saver tab.
3. Select a screen saver from the list. Although there are several available, consider using a simple one such as "Blank."
4. The value for Wait should be no more than 30 minutes.
5. Select the On resume, password protect option.

37

Windows provides the Encrypting File System as a built-in mechanism to allow the encryption of individual users’ files and folders. Be aware of the caveats involved in the use of EFS before implementing it for general use, though.

In addition to EFS, other options such as PGP and GNUPG exist.

38

Windows Server 2003 has a feature called Windows File Protection which automatically checks certain key files and replaces them if they become corrupted. It is enabled by default.

You can audit in much more in depth using Tripwire. Tripwire has a charge. The Tripwire management console can be very helpful for managing more complex installations.

40

This setting is configured using the Terminal Services Configuration tool. On the General tab of the properties of the RDP connection, select High from the list next to encryption level.