Vulnerability Description: The Microsoft Windows operating system contains a Group Policy snap-in, which can be used to configure security settings on individual computers. The Local Security Settings snap-in can be used to configure account policies, audit policies, user rights, security options and user right assignment. Some of these security options were found to be undefined on most of the servers. These settings enable to configure the server against a few known security attacks.
Risk Level: High
When these settings are left untouched, an intruder can exploit these settings to gain more information regarding the server.
For example, an intruder can anonymously enumerate the list of user accounts and shares which exist on the server, due to a flaw in the manner in which Microsoft-based servers enable access to these resources. A potential intruder will gain sufficient and useful information to launch a penetration. This is just one example of what can be blocked by the security option.
Initial Recommendations:
? All servers should be configured with the appropriate Security Policy. It is important to emphasise that these settings should be evaluated by the system administrator in a test environment.
? Critical settings:
o Windows 2000 only – Additional restrictions for anonymous connections – No access without explicit anonymous permissions
o Do not allow enumeration of SAM and shares ? enabled
o Do not allow storage of credentials or .NET passport for network authentication ? enabled
o LAN Manager authentication level – Send LM & NTLM use NTLMv2 session security if negotiated
o Do not store LAN Manager hash value on next password change – enabled
o Number of previous logons to cache (in case domain controller is not available) – 0
? Important settings:
o Audit the use of backup and restore privileges – enabled
o Restrict CD-ROM access to locally logged-on users only ? enabled
o Restrict floppy access to locally logged-on users only ? enabled
? Nice to have settings:
o Do not display last user name ? enabled
o Should be a message text for the login process
o Rename administrator & guest accounts
? Backup the server before configuring any new registry keys or a local policy.
—
implement ?
