【正文】 st username in login screen.n Configure Public Key Policy.n Configure IP Security Policy.74Copyright 2023 MarchanyFileSystemConfiguration.(__)DefineSystemConfigurationandServicePackLevel(__)DuringAudit,setbrowsertoseeallfiles(__)SystemisconfiguredasNTFSfilesystem?(__)SystemAdministratorhasacurrentEmergencyRecoveryDiskinalockedstoragearea.(__)Wipingofsystempagefileoccursatsystemshutdown.75Copyright 2023 MarchanySample W2K Level 1 Ruler n Group Policyn MMC SnapInn System Toolsn Configure Event Log Settingsn System Informationn Performance Logs Alertsn Local Users Groupsn Lock out unauth’d Floppy Disk use76Copyright 2023 MarchanySample W2K Level 1 Rulern Disable unused servicesn Remove OS2 and POSIX subsystemsn Secure Remote control programs (PC Anywhere)n Disable Microsoft Network Clientn Additional Utilitiesn W2K Suppot toolsn Resource Kit tools77Copyright 2023 MarchanySample W2K Level 1 Rulern Freeware, Shareware and Commercial Toolsn Use Access Control List Auditing Toolsn Audit SP and HotFix levelsn Consider installing nmap, WinDump, PGP, AntiTrojan, L0phtCrack 3, snort78Copyright 2023 MarchanySample W2K Level 1 Ruler – The Registryn Disable autorun on CD ROM Drives.n Control Remote Registry Access.n Restrict Null User access to named pipes and shares.n Disable Router discovery.n Disable ICMP Redirects.n Remove Administrative Shares.79Copyright 2023 MarchanySample W2K Level 1 Rulern File Folder and Registry Permissionsn Security Analysis and Configuration Tooln Apply standard Incremental Security Templatesn Create Custom Policiesn Perform analysis of putern Recovery Optionsn Baseline System backupn Regular System backupn Remote System backupn 80Copyright 2023 MarchanySample W2K Level 1 Rulern Recovery Options (Continued)n Emergency Repair Disksn Safe Mode with or without workingn Safe Mode with mand promptn Recovery Consolen Active Directory Servicesn Domain Controllers and Trustn The Trees vs. the Forestn Enterprise Admins and Schema Admins81Copyright 2023 MarchanySample W2K Level 1 Rulern Application Securityn IIS v5 – CRITICAL!n Tel Servern File and Printer Sharingn Windows Services for Unix n Exchange, Outlook, Outlook Expressn SQLn These may be more suited to Level 282Copyright 2023 MarchanyA Sample NT Level 1 Rulern Installationn Networkingn User Accountsn Services/Systemn Files/Directoriesn Registryn Applicationsn Developed by Marc Debonis, VA Tech83Copyright 2023 MarchanySample VT Level 1 NT Rulern Installationn Physically secure machinen Enable BIOS boot password, user/admin levelsn Install NT on C:, no dual boot, use NTFSn Put bogus name for installn Select only TCP/IP to installn Do NOT install IISn Do NOT use DHCPn Do NOT use WINS server entries84Copyright 2023 MarchanySample VT Level 1 NT Rulern Installationn Disable LMHOSTS lookupn Login as Administratorn Delete MyBriefCase, Install IIS, IE, Inbox iconsn Install post SP5/SP6 hotfixesn Install in this order: WinhlpI, Nddefixi, Lsareqi, Q234351I, Csrssfxi, Loctlfxi, Ntfsfix1, Igmpfix1, Ipsrfixi85Copyright 2023 Marchany(__) Define Service Pack LevelStartRunWINVER(worksthesameforNT)86Copyright 2023 MarchanyChecking for Service Packs87Copyright 2023 Marchany88Copyright 2023 Marchany(__) System does not haveunnecessary devicesStart Settings Control Panel Devices.89Copyright 2023 MarchanySample VT Level 1 Rulern Networkingn Use work control panel to remove RPC Configuration, NetBIOS Interface, Workstation, Server.n Set service TCP/IP NetBIOS Helper to disabledn Disable Windows NT Networking n Disable WINS Client (TCP/IP) bindingn Disable WINS Client (TCP/IP) device90Copyright 2023 MarchanySample VT Level 1 Rulern Accountsn Set minimum password length to 8n Lockout after 3 bad attempts ?n Under Policies User Rightsn Select Right/Access this puter from Network and remove ALL groups listed in the Grant To boxn Under Show Advanced Rights, select Bypass Traverse Checking, remove Everyonen Select Log on Locally and disable guest91Copyright 2023 MarchanySample VT NT Level 1 Rulern Accountsn Select Policies Auditn Enable audit events: logon/logoff, user/group mgt, security policy changed, restart, shutdown and systemn Open User Manager for Domainsn Rename Administrator account to Mastern Remove Description for Master Accountn Set Master account password to something VERY strongn Rename Guest account to DEFUNCTn Allow remote lockout of administrator account only92Copyright 2023 Marchany(__) Auditing is Enabled93Copyright 2023 MarchanyAudit Best Practice94Copyright 2023 MarchanyAudit Best Practice (2)95Copyright 2023 MarchanyPasswords(__)NTpasswordpoliciesplywithBestPracticesforNTPasswords.(__)Userpasswordsareknownonlybytheuser.(__)UsersarerequiredtomaintainuniquepasswordsforeachAIS.(__)PasscrackforWindowsNTorotherpasswordtesterisrunatleastyearly.(__)Passworddatabase(SAM)isencrypted.(__)Administratorpasswordisprotectedtothesamelevelasthedatacontainedontheputer.(__)Passwordisenabledforscreensaver.(ControlPanel,Desktop)96Copyright 2023 MarchanyPassfilt97Copyright 2023 MarchanyNTStartProgramsAdministrativeProgramsUserManager98Copyright 2023 MarchanyWin2k,MyComputerControlpanel,AdministrativeToolsLocalSecurityPolicyPasswordPolicy99Copyright 2023 MarchanySample VT NT Level 1 Rulern Services/Systemn Disable unnecessary system servicesn Network DDE, Network DDE DDSM, Schedule, Spooler, Telephony service, distributed DCOMn From System Control Panel, click Startup/Shutdown tabn Uncheck Overwrite any Existing File?n Uncheck Write debugging info to:n Uncheck Automatically