Security

Ask something
Discussion Locked

Domain secured

0 helpful
2 replies

by qmd61 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have 2 problems on my Network, would you please explaining to me How to fix them:

1. I create a domain with Server running Windows 2000 for Small Business, I have 15 clients PC running Windows 2000 Professional. I just bought a new PC, as soon as I connect this PC to the Hup and boot it up; Although I do not joint this PC to the Domain. I could use Windows Explorer to Browse and see the whole Network but I could only access the share drive of some Clients (not all). This tell me that my network was not setup right and it is not secure at all, any one could plug their desktop to the Hup and then access my Network?I install the DC in Default setup, I have not create any GPO yet.
2. The second problem is happen to all PC in the domain:sometime I could not see all Computer on the Network. For example, if I open Windows Explorer, under my Network place and My Domain name, some time I see all PC and sometime there is nothing under Domain. However, If I could access to the shared drive on any PC by Map it with a drive letter.

I try to reinstall DHCP, DNS but it does not help. I appreciate on any suggestion.

2 replies

by timwalsh

Did you log onto the computer in question with a user ID and password that is valid for the domain?

If so, you are using what is called pass-through authentication. This will work whether you are joined to the domain or not.

Try creating an account on the computer in question, with a user ID and password that are NOT valid anywhere in the rest of the domain, and then try accessing any domain resources. You should not be able to access anything.

by lordinfidel

Your domain model is not set up correct.

Here is my method for securing machines and domains (this is based on a hacking standpoint)

This scenario is for when you 1st build a domain and or a standalone machine. Do not hook up the machine to the net until you are done securing the machine.

1. Leave admin accounts alone. Leave them set to administrator no password. (weird I know, there is a reason for this.

2. Install all sp's and hot fixes.
3. Create all global/local groups.
4. Create all domain/local users.
5. Creat a new local admin/domain admin user.
assign a 14 charcter (not 15, not 13, but 14)
pwd to it. Write down the pwd. (I use efs
to protect my passwords, but this is another subject)

6. Create a 28 charcter indecephirable password for the guest account. Write it down. Assign the password to it. Make sure the account is disabled.

7. open up the administrator account. Copy the description and paste it in the description of the guest acount.

8. rename the administrator account.

9. rename the guest account to administrator.

10. delete the descrition of the administrator account.

11. assign a 14 charcter password to the adminisrtator account. write it down.

12. Log off and log back on as the admin account you created in step 5.

13. Remove the profile thru the wizard for the administrator account.

14. Never log in as the true admin account ever again.

15. If there are any Iusr or Term serv accounts, set there password to the 28 chrctr password, disable term serv account.

This discussion is closed to new replies.