The following is tip #10 from "10 tips in 10 minutes: Configuring Windows 2000 Server," excerpted from Chapter 6 in the book Microsoft Windows 2000 Server Administrator's Companion, Second Edition, published by Microsoft Press.
Entire books could be (and have been) written about securing Windows 2000 Server, and rightly so; it's an important topic (and one that we devote considerable space to, including Chapters 18 and 19). We won't launch a big security discussion here, but some security precautions are necessary before considering your server "online." (For a detailed explanation of Microsoft's suggestions, see http://www.microsoft.com/technet/security/tools/w2ksvrcl.asp). Here's what Microsoft recommends:
- Eliminate FAT (make sure all hard disk partitions are using NTFS).
- Rename the administrator account and create a strong password for it (and use a different password for each server).
- Set appropriate password policies and account lockout policies for your network.
- Disable unnecessary services, especially Internet Information Services. If not doing file or printer sharing, disable the Server service.
- Don't install unnecessary applications such as e-mail, Microsoft Office, or utilities.
- Disable unnecessary accounts.
- Check folder permissions.
- Disable the Guest account.
- Protect the registry from anonymous access.
- Apply appropriate registry access control lists (ACLs).
- Restrict access to the Local System Authority (LSA).
- Remove unnecessary file shares.
- Install antivirus software and the latest virus definition files.
- Install the latest service pack.
- Install security hot fixes as appropriate for your network.
If you put in the planning time recommended in the first part of this chapter, it's probably paying off around now. Although the configuration of various services and protocols is relatively complex, primarily because of the interdependencies among them, you should have a good idea of which services and protocols will best suit the needs of your network in a Windows 2000 environment.
10 tips in 10 minutes: Configuring Windows 2000 Server
Tip 1: Checking for setup problems
Tip 2: Configuring devices
Tip 3: Using Device Manager
Tip 4: Troubleshooting devices
Tip 5: Configuring Networking Settings
Tip 6: Using the Windows 2000 Configure Your Server Tool
Tip 7: Configuring the first server on your network
Tip 8: Performance and memory tuning
Tip 9: Updating Windows
Tip 10: Securing Windows
This chapter excerpt from Microsoft Windows 2000 Server Administrator's Companion, Second Edition by Charlie Russel, Sharon Crawford and Jason Gerend is printed with permission from Microsoft Press, Copyright 2002. Click here for the chapter download or to purchase the book.