Child pages
  • Windows Server 2012 R2 Hardening Checklist

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

1

Anchor
r1
r1

If other alternatives are unavailable, this can be accomplished by installing a SOHO router/firewall in between the network and the host to be protected.

2

Anchor
r2
r2

The Security Configuration Wizard can greatly simplify the hardening of the server. Once the role for the host is defined, the Security Configuration Wizard can help create a system configuration based specifically on that role. It does not completely get rid of the need to make other configuration changes, though. More information is available at: Security Configuration Wizard.

3

Anchor
r3
r3

There are several methods available to assist you in applying patches in a timely fashion:

Microsoft Update Service

  • Microsoft Update checks your machine to identify missing patches and allows you to download and install them.
  • This is different than the "Windows Update" that is the default on Windows. Microsoft Update includes updates for many more Microsoft products, such as Office and Forefront Client Security.
  • This service is compatible with Internet Explorer only. 


Windows AutoUpdate via WSUS
ITS offers a Windows Server Update Services Server for campus use using Microsoft's own update servers. It includes updates for additional Microsoft products, just like Microsoft Update, and provides additional administrative control for software deployment.

Microsoft Baseline Security Analyzer
This is a free host-based application that is available to download from Microsoft. In addition to detailing missing patches, this tool also performs checks on basic security settings and provides information on remediating any issues found.

4

Anchor
r4
r4

Configure Automatic Updates from the Automatic Updates control panel

  • On most servers, you should choose either "Download updates for me, but let me choose when to install them," or "Notify me but don't automatically download or install them."
  • The campus Windows Server Update Services server can be used as the source of automatic updates.
5
Anchor
r5
r5
Configuring the minimum password length settings is important only if another method of ensuring compliance with university password standards is not in place. The Information Resources Use and Security Policy requires passwords be a minimum of 8 characters in length. It is strongly recommended that passwords be at least 14 characters in length (which is also the recommendation of CIS).

6

Anchor
r6
r6

Configuring the password complexity setting is important only if another method of ensuring compliance with university password standards is not in place. The Information Resources Use and Security Policy requires that passwords contain letters, numbers, and special characters.

7

Anchor
r7
r7

If this option is enabled, the system will store passwords using a weak form of encryption that is susceptible to compromise. This configuration is disabled by default.

8
Anchor
r8
r8

Instead of the CIS recommended values, the account lockout policy should be configured as follows:

  • Account lockout duration — 5 minutes
  • Account lockout threshold — 5 failed attempts
  • Reset account lockout counter — 5 minutes
11
Anchor
r11
r11
Any account with this role is permitted to log in to the console. By default, this includes users in the Administrators, Users, and Backup Operators groups. It's unlikely that non-administrative users require this level of access and, in cases where the server is not physically secured, granting this right may facilitate a compromise of the device.
13
Anchor
r13
r13
The text of the university's official warning banner can be found on the ITS Web site. You may add localized information to the banner as long as the university banner is included.
14
Anchor
r14
r14

The use of Microsoft accounts can be blocked by configuring the group policy object at: 

Code Block
Computer Configuration\Windows Settings\Security Settings\Local Policies\
Security Options\Accounts: Block Microsoft accounts
 

This setting can be verified by auditing the registry key:

Code Block
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoConnectedUser
42
Anchor
r42
r42

Logon information for domain accounts can be cached locally to allow users who have previously authenticated to do so again even if a domain controller cannot be contacted. By default 10 accounts will be cached locally, but there is a risk that in the event of a compromise an attacker could locate the cached credentials and use a brute force attack to discover the passwords. Therefore, it is recommended that this value be reduced so that fewer credentials will be placed at risk, and credentials will be cached for shorter periods of time in the case of devices that are logged into frequently by multiple users.

The group policy object below should be set to 4 or fewer logons:

Code Block
Computer Configuration\Windows Settings\Security Settings\Local Policies\
Security Options\Interactive logon: Number of previous logons to cache (in 
case domain controller is not available)
43
Anchor
r43
r43

The Account Logon audit policy logs the results of validation tests of credentials submitted for user account logon requests. The server that is authoritative for the credentials must have this audit policy enabled. For domain member machines, this policy will only log events for local user accounts.

Set Configure the group policy object below to "Success and Failure"match the listed audit settings:

Code Block
Computer Configuration\Windows Settings\Security Settings\
Advanced Audit Policy Configuration\Audit Policies\Account Logon\
Audit Policy: Account Logon: Credential Validation
  • Credential Validation — Success and Failure
44
Anchor
r44
r44

Configure the group policy object below to match the listed audit settings:

Code Block
Computer Configuration\Windows Settings\Security Settings\
Advanced Audit Policy Configuration\Audit Policies\Account Management\
  • Computer Account Management — Success and Failure
  • Other Account Management Events — Success and Failures
  • Security Group Management — Success and Failure
  • User Account Management — Success and Failure
45
Anchor
r45
r45

Configure the group policy object below to match the listed audit settings:

Code Block
Computer Configuration\Windows Settings\Security Settings\
Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\
  • Account Lockout — Success
  • Logoff — Success
  • Logon — Success and Failure
  • Other Logon/Logoff Events — Success and Failure
  • Special Logon — Success
46
Anchor
r46
r46

Configure the group policy object below to match the listed audit settings:

Code Block
Computer Configuration\Windows Settings\Security Settings\
Advanced Audit Policy Configuration\Audit Policies\Policy Change\
  • Audit Policy Change — Success and Failure
  • Authentication Policy Change — Success
47
Anchor
r47
r47

Configure the group policy object below to match the listed audit settings:

Code Block
Computer Configuration\Windows Settings\Security Settings\
Advanced Audit Policy Configuration\Audit Policies\Privilege Use\
  • Sensitive Privilege Use — Success and Failure

48

Anchor
r48
r48

The university requires the following event log settings instead of those recommended by the CIS Benchmark:

  • Application: Maximum log size — 32,768 KB
  • Security: Maximum log size 196,608 KB
  • Setup: Maximum log size — 32,768 KB
  • System: Maximum log size — 32,768 KB

The recommended retention method for all logs is: Overwrite events older than 14 days

 

These are minimum requirements. The most important log here is the security log. 100 MB is a suggested minimum, but if you have a high-volume service, make the file as large as necessary to make sure at least 14 days of security logs are available. You may increase the number of days that you keep, or you may set the log files to not overwrite events.

Note that if the event log reaches its maximum size and no events older than the number of days you specified exist to be deleted, or if you have disabled overwriting of events, no new events will be logged. This may happen deliberately as an attempt by an attacker to cover his tracks. For critical services working with Cat 1 or other sensitive data, you should use syslog, Splunk, Intrust, or a similar service to ship logs to another device.

Another option is to configure Windows to rotate event log files automatically when an event log reaches its maximum size as described in the article http://support.microsoft.com/kb/312571 using the the AutoBackupLogFiles registry entry.

49

Anchor
r49
r49

It is highly recommended that logs are shipped from any Category I devices to a service like Splunk, which provides log aggregation, processing, and real-time monitoring of events among many other things. This helps to ensure that logs are preserved and unaltered in the event of a compromise, in addition to allowing proactive log analysis of multiple devices.

Splunk licenses are available through ITS at no charge. ITS also maintains a centrally-managed Splunk service that may be leveraged.

52

Anchor
r52
r52

Configure user rights to be as secure as possible, following the recommendations in section 2.2 of the CIS benchmark. Every attempt should be made to remove Guest, Everyone, and ANONYMOUS LOGON from the user rights lists.

53

Anchor
r53
r53

Volumes formatted as FAT or FAT32 can be converted to NTFS, by using the convert.exe utility provided by Microsoft. Microsoft has provided instructions on how to perform the conversion.Windows servers used with Category I data must use the NTFS file system for all partitions where Category I data is to be stored.

54

Anchor
r54
r54

Be extremely careful, as setting incorrect permissions on system files and folders can render a system unusable.

55

Anchor
r55
r55

Be extremely careful, as setting incorrect permissions on registry entries can render a system unusable.

56
Anchor
r56
r56

Some remote administration tools, such as Microsoft Systems Management Server, require remote registry access to managed devices. Disabling remote registry access may cause such services to fail. If remote registry access is not required, it is recommended that the remote registry service be stopped and disabled.

If remote registry access is required, the remotely accessible registry paths should still be configured to be as restrictive as possible. The group policy object below controls which registry paths are available remotely:

Code Block
Computer Configuration\Windows Settings\Security Settings\Local Policies\
Security Options\Network access: Remotely accessible registry paths

This object should be set to allow access only to:

  • System\CurrentControlSet\Control\ProductOptions
  • System\CurrentControlSet\Control\Server Applications
  • Software\Microsoft\Windows NT\CurrentVersion

Further restrictions on the registry paths and subpaths that are remotely accessible can be configured with the group policy object:

Code Block
Computer Configuration\Windows Settings\Security Settings\Local Policies\
Security Options\Network access: Remotely accessible registry paths and sub-paths


57

Anchor
r57
r57

By default, domain members synchronize their time with domain controllers using Microsoft's Windows Time Service. The domain controller should be configured to synchronize its time with an external time source, such as the university's network time servers.

ITS Networking operates two stratum 2 NTPv4 (NTP version 4) servers for network time synchronization services for university network administrators.

58

Anchor
r58
r58

ITS provides FireAMP, a managed, cloud-based antivirus service, free of charge for all university owned devices. More information about obtaining and using FireAMP is at http://www.utexas.edu/its/products/antivirus/.

59

Anchor
r59
r59

Anti-spyware software is only required to be installed if the server is used to browse Web sites not specifically related to the administration of the server, which is not recommended. ITS provides anti-spyware software for no additional charge. At a minimum, SpyBot Search and Destroy should be installed. We also recommend the installation of a secondary anti-spyware application, such as SpyWare Blaster, EMS Free Surfer, or AdAware. Both SpyWare Blaster and EMS Free Surfer are available from BevoWare.

An additional measure that can be taken is to install Firefox with the NoScript and uBlock add-ons.

60

Anchor
r60
r60

FireAMP is the recommended AV solution. Microsoft Forefront may also be used, and can be configured directly or through the use of GPOs, which can simplify the management of multiple servers.

61

Anchor
r61
r61

Spyware Blaster - Enabling auto-update functionality requires the purchase of an additional subscription.
SpyBot Search and Destroy - Automatic update tasks can be created inside the program itself and are scheduled using the Windows Task Scheduler.

  1. In the Spybot Application, click on Mode --> Advanced View.
  2. Click Settings on the left hand side of the window.
  3. You should now see an option labeled "Scheduler." Select that option.
  4. Adding the task to update automatically is relatively straightforward.
    • Click Add to create a task.
    • Click Edit to edit the task schedule.
    • In the Scheduled Task window that pops up, enter the following In the Run field:

      Code Block
      C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /AUTOUPDATE /TASKBARHIDE /AUTOCLOSE
    • Click the Schedule tab and choose a time for it to update. The duration of the update is very brief, but it is processor intensive, so consider scheduling it to occur during periods of low usage. The task should be scheduled daily.

62

Anchor
r62
r62

Windows provides the Encrypting File System as a built-in mechanism to allow the encryption of individual users' files and folders. Be aware of the caveats involved in the use of EFS before implementing it for general use, though. Other options such as PGP and GNUPG also exist.

Another encryption option to consider is whole-disk encryption, which encrypts the entire contents of the drive instead of just specific files and folders. Windows comes with BitLocker for this.

If encryption is being used in conjunction with Category I data, one of the solutions listed in the Approved Encryption Methods (EID required) must be implemented.

63

Anchor
r63
r63

Windows has a feature called Windows Resource Protection which automatically checks certain key files and replaces them if they become corrupted. It is enabled by default.

You can audit in much more in depth using Tripwire. Modern versions of Tripwire require the purchase of licenses in order to use it. The Tripwire management console can be very helpful for managing more complex installations.

64

Anchor
r64
r64

This setting is configured by group policy object at:

Code Block
\Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\
Remote Desktop Session Host\Security

This policy object should be configured as below:

  • Set client connection encryption level — High
  • Require use of specific security layer for remote (RDP) connections — SSL (TLS 1.0)
  • Require user authentication for remote connections by using Network Level Authentication — Enabled

69

Anchor
r69
r69

  1. Open the Display Properties control panel.
  2. Select the Screen Saver tab.
  3. Select a screen saver from the list. Although there are several available, consider using a simple one such as "Blank."
  4. The value for Wait should be no more than 15 minutes.
  5. Select the On resume, password protect option.

...