Securing Windows

The following is tip #10 from "10 tips in 10 minutes: Configuring Windows 2000 Server," excerpted from Chapter 6 in the book Microsoft Windows 2000 Server Administrator's Companion, Second Edition, published by Microsoft Press.

Entire books could be (and have been) written about securing Windows 2000 Server, and rightly so; it's an important topic (and one that we devote considerable space to, including Chapters 18 and 19). We won't launch a big security discussion here, but some security precautions are necessary before considering your server "online." (For a detailed explanation of Microsoft's suggestions, see http://www.microsoft.com/technet/security/tools/w2ksvrcl.asp). Here's what Microsoft recommends:

• Eliminate FAT (make sure all hard disk partitions are using NTFS).
• Rename the administrator account and create a strong password for it (and use a different password for each server).
• Set appropriate password policies and account lockout policies for your network.
• Disable unnecessary services, especially Internet Information Services. If not doing file or printer sharing, disable the Server service.
• Don't install unnecessary applications such as e-mail, Microsoft Office, or utilities.
• Disable unnecessary accounts.
• Check folder permissions.
• Disable the Guest account.
• Protect the registry from anonymous access.
• Apply appropriate registry access control lists (ACLs).
• Restrict access to the Local System Authority (LSA).
• Remove unnecessary file shares.
• Install antivirus software and the latest virus definition files.
• Install the latest service pack.
• Install security hot fixes as appropriate for your network.

Summary
If you put in the planning time recommended in the first part of this chapter, it's probably paying off around now. Although the configuration of various services and protocols is relatively complex, primarily because of the interdependencies among them, you should have a good idea of which services and protocols will best suit the needs of your network in a Windows 2000 environment.

10 tips in 10 minutes: Configuring Windows 2000 Server

  Introduction
  Tip 1: Checking for setup problems
  Tip 2: Configuring devices
  Tip 3: Using Device Manager
  Tip 4: Troubleshooting devices
  Tip 5: Configuring Networking Settings
  Tip 6: Using the Windows 2000 Configure Your Server Tool
  Tip 7: Configuring the first server on your network
  Tip 8: Performance and memory tuning
  Tip 9: Updating Windows
  Tip 10: Securing Windows