Securing Windows 2000

Introduction

By default, Windows 2000 installations contain numerous potential security problems. Many unneeded services are installed and enabled, and there is no active local security policy. This document attempts to provide a solid foundation for the beginning administrator. Remember to test these tactics on a non-production server, particularly when applying a new service pack or hotfix. Most of the recommendations below are suggested to protect the server from compromise by automated scripts launched by novice hackers or by rapidly propagating Trojan horse programs.

These methods are certainly not exhaustive, although they should be seriously considered by anyone concerned with a basic level of security. According to the SANS “Top 20 Most Critical Internet Security Vulnerabilities,” a system’s most insecure phase is its initial configuration after a default installation. It is strongly recommended that the administrator physically disconnect the network cable after installing the operating system as the system can easily be compromised during the early stages of configuration and customization.

Converting to NTFS

During the installation, make sure you convert your drive partitions to NTFS. NTFS allows the administrator to set access-control lists (ACLs) on files and directories. This will allow the administrator to keep a tighter control over what services get started, and which files get modified or created.


Creating Groups

Create separate and specialized groups for the user accounts on the system. Using this model, an administrator can determine the needs of the individual account and add them to as many groups as it may need to perform its tasks. For example, on a system where multiple users work together to maintain a Web site, the administrator could create separate groups for the Web programmers, the graphic artists, and the content authors. Every group would have permission to access different files on the system (e.g. the graphic designers can be prohibited from viewing or making changes to the cgi-bin directory, while the Web programmers cannot manipulate files in the images directory). Each user could belong in one, some, or all groups. The key is to allow users access only to the minimum amount of resources they need to complete their work. The “system” and administrator groups should have full access to the entire site.


Securing Guest and Administrator Accounts

Make sure the Guest account is disabled, and consider changing the Administrator account name to prevent automated scripts from trying to brute-force a login through the Administrator account. You could rename Administrator to Keith or User or even to Guest!

Disabling TCP/IP and IIS

Do not install simple TCP/IP Services or Internet Information Services (IIS) unless these services will be immediately utilized. These services can always be installed and configured later if the need arises. If for some reason IIS does get installed, remove it using the Add/Remove Programs utility in the Control Panel. Disable any services that are not absolutely necessary for the routine performance of the system through the Services module under Administrative Tools. Microsoft provides a listing of Windows 2000 services and their descriptions.


Windows Update

Install all the service packs and updates available from the Windows Update site before the system goes into production. Once it is in production, test future patches first on a test server that is similar to your current system. Ideally the service packs and hotfixes should be downloaded on another system and written to a CD or other removable media so that the packs can be installed without having to connect the unshielded and outdated system to the Internet. Obtain a copy of the HFNetChk tool and run it frequently to see if there may be new patches your system may need to plug security holes or address performance problems.

Anti-Virus and Firewall Software

Install and frequently update Microsoft AntiVirus software on the system to prevent compromises from Trojans, worms, and viruses. UNC-Chapel Hill maintains free licenses for employees and students, available at https://shareware.unc.edu/. Use Task Scheduler to run the Live Update feature at least once a week to keep virus protection on the system up to date. Of course when a new threat is issued, be sure to run LiveUpdate immediately. Also, consider installing a personal firewall to protect the system from any unauthorized or unwanted network activity.

Disabling Sharing

Unless you will definitely use them, remove from Network Properties both “File and Printer Sharing” and the default sharing of the local drives. For example, the C$ is shared by default and should be unshared immediately unless a specific application requires it or if the administrators wish to make major system changes remotely. When a system is rebooted, however, the default share can return. In order to make this change permanent, a registry key needs to be changed. Under

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters

set AutoShareServer to 0, or, if there is no entry, add a value of type REG_DWORD and set that to 0. This will permanently disable all drive letter sharing and also disable the Remote Admin share (ADMIN$).

If administrators work on the system remotely, ensure that they use a secure channel to make changes. Set the encryption level to “High” on the Microsoft Terminal Services if this is the remote administration protocol used (note that Terminal Services come with Windows 2000 Server by default).


Creating a Local Security Policy

The Administrative tools in the Control Panel allow you to create and configure a local security policy for all users. There are also existing templates in the c:\winnt\security\templates folder that contain a variety of pre-configured settings for different systems. Consider applying one of these templates and then customizing to more accurately reflect the needs and security goals of your system. The National Security Agency ( NSA) is another great resource for pre-configured security templates. Note that at minimum, the security policy should contain something other than the default under the Additional restrictions for anonymous connections. This can also be changed by creating the following registry key:

HKLM\System\CurrentControlSet\Control\Lsa\RestrictAnonymous

Value  Name:  RestrictAnonymous
Data  Type:  REG_DWORD
Value:  1

For NT and mixed environments choose ‘1’ for the data field. Or choose the “Do not allow enumeration of SAM accounts and shares” directive. For pure Windows 2000 environments, or for the paranoid, choose the data value of ‘2’ or “No access without explicit anonymous permission [shown below].” This will prevent NULL session attacks, which are a common and frequent threat. For more information on NULL sessions and their vulnerabilities, please refer to the SANS site.

Also see the Microsoft Knowledgebase articles on restricting information available to anonymous logon users and using the’RestrictAnonymous’ registry value.


Enabling Auditing for Log Files

Make sure to enable auditing in the security policy in order to obtain a good set of log files. Your log files are your main ammunition against attackers whether your system is compromised or not. Also consider moving your log files from their default location to another part of the system (preferably another partition devoted only to the logs). Ensure that only administrators can read the system logs and that no other users have read permissions.


The Microsoft Baseline Security Analyzer is a great tool that provides a cursory look at the security status of your system. As always, if you would like a vulnerability scanner run on your system after it has been secured, the ITS Security office will be happy to run a scan and email you the reports. Please contact us at security@unc.edu for more information.