Security Configuration and Analysis

You can use Security Configuration and Analysis to analyze and configure local computer security.

  • Before proceeding, see Checklist: Securing your computers using Security Configuration Manager.
  • For help with specific tasks, see How To.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.
  • Other security policy tools:
Security Configuration Manager Tool | Description
Security Templates | Defines a security policy in a template. These templates can be applied to Group Policy or to your local computer.
Security Settings extension to Group Policy | Edits individual security settings on a domain, site, or organizational unit.
Local Security Policy | Edits individual security settings on your local computer.
Secedit.exe | Automates security configuration tasks at a command prompt.

For more information on the individual security settings, see Security settings descriptions.


Best practices

Security Configuration and Analysis is a tool which can be used to analyze and configure computer security. For general security issues, see Security Best Practices.

If you require frequent analysis of a large number of computers, as with a domain-based infrastructure, use the Secedit.exe command prompt tool.

For more information, see Automating security configuration tasks.

Only use Security Configuration and Analysis to configure security areas not affected by Group Policy settings.

This includes areas such as security on local files and folders, registry keys, and system services. Otherwise, Group Policy settings will override the local settings. For more information, see Order of processing settings.

Do not use Security Configuration and Analysis when you are configuring security for a domain or an organizational unit.

Otherwise, you must configure each client individually. In that case, you can:

  • Use Security Templates to create a template and apply it to the appropriate Group Policy object.
    • For more information, see To import a security template to a Group Policy object.
  • Use the Security Settings extension to Group Policy to edit individual security settings on a Group Policy object. For more information, see To edit a security setting on a Group Policy object.


How to ...

  • Install Security Configuration and Analysis
  • Analyze system security
  • Configure system security
  • Reapply default security settings
  • Import a security template
  • Export a security template
  • Edit the analysis database


Add Security Configuration and Analysis to an MMC console

Microsoft Windows graphic

To add Security Configuration and Analysis to an MMC console

  1. Click Start, click Run, then type mmc and click OK.
  2. Do one of the following:
    • To create a new console, on the File menu, click New.
    • To open an existing console, on the File menu, click Open, click the console you wish to open, and then click Open.
  3. On the File menu, click Add/Remove Snap-in, and then, in Add/Remove Snap-in, click Add.
  4. Click Security Configuration and Analysis and click Add.
  5. Click Close, then click OK.

Notes

  • XOX
  • For more information, see Working with MMC console files.

Related Topics


Analyze system security

Microsoft Windows graphic

To analyze system security

Using the Windows interface

  1. Open Security Configuration and Analysis.
  2. In the console tree, right-click Security Configuration and Analysis and click Open Database.

    Where?

    • ConsoleRoot
    • Security Configuration and Analysis
  3. In Open database, do one of the following:
    • To create a new database, in File name, type a file name and click Open.
    • To open an existing database, click a database and click Open.
  4. If you are creating a new database, in Import Template, click a template and click Open.
  5. In the details pane, right-click Security Configuration and Analysis, and then click Analyze Computer Now.
  6. Do one of the following:
    • To use the default log, in Error log file path, click OK.
    • To specify a different log, in Error log file path, type a valid path and file name.

Notes

  • XOX
  • To open Security Configuration and Analysis, click Start, and click Run, then type mmc and click OK. On the File menu, click Open, click the console that you want to open, then click Open. Then, in the console tree, click Security Configuration and Analysis.
  • Security Configuration and Analysis displays the different security areas as they are analyzed. Once this is complete, you can check the log file or review the results. See Related Topics to review the analysis results.
  • To view the log file, right-click Security Configuration and Analysis, and then click View Log File.
  • The default path for the log file is:

    systemroot\Documents and Settings\UserAccount\My Documents\Security\Logs\DatabaseName.log

Using a command line

secedit /analyze

  • Open Command Prompt
  • Type:

    secedit /analyze /DB FileName [/CFG FileName ] [/log LogPath][/quiet]

Argument | Description
/DB FileName | Required. Provides the path to a database that contains the security template that should be applied.
/CFG FileName | This argument is only valid when used with the /DB parameter. It is the path to at least one security template that will be imported into the database and applied to the system. If this argument is not specified, the template that is already stored in the database is applied.
/log LogPath | Path to the log file for the process. If not specified, the default path is used (%windir%\Security\Logs\Scesrv.log).
/quiet | Suppresses screen and log output.

Notes

  • XOX
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    secedit /?

Related Topics


Configure system security

Microsoft Windows graphic

To configure system security

Using the Windows interface

  1. Open Security Configuration and Analysis
  2. In the console tree, right-click Security Configuration and Analysis, and then click Open Database.

    Where?

    • ConsoleRoot
    • Security Configuration and Analysis
  3. In Open database, do one of the following:
    • To create a new database, in File name, type a file name and click Open.
    • To open an existing database, click a database and click Open.
  4. If you are creating a new database, in Import Template, click a template and click Open.
  5. In the console tree, right-click Security Configuration and Analysis, and then click Configure Computer Now.
  6. Do one of the following:
    • To use the default log, in Error log file path, click OK.
    • To specify a different log, in Error log file path, type a valid path and file name.

Notes

  • XOX
  • To open Security Configuration and Analysis, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. In the console tree, click Security Configuration and Analysis.
  • To check the log file, right click Security Configuration and Analysis, and then click View Log File.
  • The default path for the log file is:

    systemroot\Documents and Settings\UserAccount\My Documents\Security\Logs\

Using a command line

  • Open Command Prompt
  • Type:

    secedit/configure /DB FileName [/CFG FileName][/overwrite][/areas Area1 Area2...] [/log LogPath] [/quiet]

Argument | Description
/DB FileName | Required. Provides the path to a database that contains the security template that should be applied.
/CFG FileName | This argument is only valid when used with the /DB parameter. It is the path to at least one security template that will be imported into the database and applied to the system. If this argument is not specified, the template already stored in the database is applied.
/overwrite | This argument is only valid when the /CFG argument is also used. This specifies whether the security template in the /CFG argument should overwrite any template or composite template stored in the database instead of appending the results to the stored template. If this is not specified, the template in the /CFG argument will be merged with the stored template.
/areas Area1 Area2... Specifies the security areas to be applied to the system. The default is All Areas. Each area should be separated by a space.
Area Name | Description
SECURITYPOLICY | Local policy and domain policy for the system, including account policies, audit policies, and so on.
GROUP_MGMT | Restricted group settings for any groups specified in the security template
USER_RIGHTS | User logon rights and granting of privileges
REGKEYS | Security on local registry keys
FILESTORE | Security on local file storage
SERVICES | Security for all defined services
/log LogPath | Path to the log file for the process..
/quiet | Suppresses screen and log output.

Notes

  • XOX
  • XOX
  • The default path for the log file is:

    %systemroot%\Security\Logs\Scesrv.log

  • To view the complete syntax for this command, at a command prompt, type:

    secedit /?

  • SecEdit /RefreshPolicy has been replaced with GPupdate. For information on how to refresh security settings, see GPupdate.

Related Topics


Reapply default security settings

Microsoft Windows graphic

To reapply default security settings

Using the Windows interface

  1. Open Security Configuration and Analysis.
  2. In the console tree, right-click Security Configuration and Analysis and then click Open Database.

    Where?

    • ConsoleRoot
    • Security Configuration and Analysis
  3. In File name, type the file name, and then click Open.
  4. In the console tree, right-click Security Configuration and Analysis and in Import Template, click Setup security and click Open.
  5. In the console tree, right-click Security Configuration and Analysis, and then click Configure Computer Now..
  6. Do one of the following:
    • To use the default log, in Error log file path, click OK.
    • To specify a different log, in Error log file path, type a valid path and file name.
  7. When configuration is done, right-click Security Configuration and Analysis, and then click View Log File.

Notes

  • XOX
  • To open Security Configuration and Analysis, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. In the console tree, click Security Configuration and Analysis.
  • The default path for the log file is

    systemroot\Documents and Settings\UserAccount\My Documents\Security\Logs\

  • When you reapply default security settings, all settings that are defined in Setup security.inf are set as the template specifies, but other settings that are not defined in the template may persist. For more information, see Persistence in security settings.

Using a command line

  • Open Command Prompt
  • Type:

    secedit /configure /DB FileName /CFG "%windir%\Security\Templates\Setup security.inf" [/overwrite][/areas Area1 Area2...] [/log LogPath] [/quiet]

Argument | Description
/DB FileName | Required. Provides the path to a database that contains the security template that should be applied. To create a new database, type in the database file name and path.
/CFG "%windir%\Security\Templates\Setup security.inf" | Specifies the Setup Security.inf template that contains the default security settings.
/overwrite | Specifies that the Setup security template overwrites any template stored in the database.
/areas Area1 Area2... Specifies the security areas to be applied to the system. The default is All Areas. Each area should be separated by a space.
Area Name | Description
SECURITYPOLICY | Local policy and domain policy for the system, including account policies, audit policies, and so on.
GROUP_MGMT | Restricted group settings for any groups specified in the security template
USER_RIGHTS | User logon rights and granting of privileges
REGKEYS | Security on local registry keys
FILESTORE | Security on local file storage
SERVICES | Security for all defined services
/log LogPath | Path to the log file. If not specified, the default path is used.
/quiet | Suppresses screen and log output.

Notes

  • XOX
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    secedit /?

Related Topics


Import a security template

Microsoft Windows graphic

To import a security template

  1. Open Security Configuration and Analysis.
  2. In the console tree, right click Security Configuration and Analysis and click Import Template.

    Where?

    • ConsoleRoot
    • Security Configuration and Analysis
  3. (Optional) To clear the database of any template which has been stored previously, select the Clear this database before importing check box.
  4. Click a template file and then click Open.
  5. Repeat the previous step for each template you want to merge into the database.

Notes

  • XOX
  • To open Security Configuration and Analysis, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. In the console tree, click Security Configuration and Analysis.
  • Importing templates to a personal database only affects the analysis database and does not affect your system settings.
  • If you import more than one template, the database will merge the various templates to create one composite template, resolving conflicts in order of import. The last template that is imported takes precedence.

Related Topics


Export a security template

Microsoft Windows graphic

To export a security template

  1. Open Security Configuration and Analysis.
  2. In the console tree, right-click Security Configuration and Analysis andclick Export Template.

    Where?

    • ConsoleRoot
    • Security Configuration and Analysis
  3. Type a valid file name and a path to the location where your template will be saved.

Note

  • XOX
  • To open Security Configuration and Analysis, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. In the console tree, click Security Configuration and Analysis. For more information, see Related Topics.

Related Topics


Edit the analysis database

Microsoft Windows graphic

To edit the analysis database

  1. Open Security Configuration and Analysis.
  2. In the console tree, right-click Security Configuration and Analysis, click Analyze Computer Now, and then click OK.

    Where?

    • ConsoleRoot
    • Security Configuration and Analysis
  3. After Security Configuration and Analysis has finished analyzing the computer, in the console tree, click the group of settings that contains the security attribute you want to edit.
  4. In the details pane, double-click the security attribute you want to edit.
  5. Select the Define this policy in the database check box.
  6. Enter a new value that will be recorded in the analysis database and click OK.
  7. Repeat the last three steps for each security attribute you want to edit.

Note

  • XOX
  • To open Security Configuration and Analysis, click Start, and click Run, then type mmc and click OK. On the File menu, click Open, click the console that you want to open, then click Open. Then, in the console tree, click Security Configuration and Analysis.
  • The changes you make will not affect system security. They will only affect the analysis database.
  • For more information, see Security setting descriptions

Related Topics


Concepts

This section provides general background information about Security Configuration and Analysis:

  • Security Configuration and Analysis overview
  • Using Security Configuration and Analysis
  • Troubleshooting


Security Configuration and Analysis overview

Security Configuration and Analysis is a tool for analyzing and configuring local system security.

Security Analysis

The state of the operating system and applications on a computer is dynamic. For example, you may need to temporaril change security levels so that you can immediately resolve an administration or network issue. However, this change can often go unreversed. This means that a computer may no longer meet the requirements for enterprise security.

Regular analysis enables an administrator to track and ensure an adequate level of security on each computer as part of an enterprise risk management program. An administrator can tune the security levels and, most importantly, detect any security flaws that may occur in the system over time.

Security Configuration and Analysis enables you to quickly review security analysis results. It presents recommendations alongside of current system settings and uses visual flags or remarks to highlight any areas where the current settings do not match the proposed level of security. Security Configuration and Analysis also offers the ability to resolve any discrepancies that analysis reveals.

Security Configuration

This tool can also be used to directly configure local system security. Through its use of personal databases, you can import security templates that have been created with Security Templates and apply these templates to the local computer. This immediately configures the system security with the levels specified in the template.

For more information, see Security Configuration and Analysis.


Using Security Configuration and Analysis

Security Configuration and Analysis offers the ability to perform database-driven configuration and analysis of security settings on the local computer.

  • Predefined security templates
  • Importing and exporting security templates
  • Analyzing security and viewing results
  • Resolving security discrepancies
  • Resources


Importing and exporting security templates

Security Configuration and Analysis provides the ability to import and export security templates into or from a working database.

If you have made any changes to the analysis database, you can save those settings by exporting them into a template. The export feature provides the ability to save the analysis database settings as a new template file. This template file can then be used to analyze or configure a system or it can be imported to a Group Policy object.

For more information, see To import a security template and To export a security template.


Analyzing security and viewing results

Security Configuration and Analysis performs security analysis by comparing the current state of system security against an analysis database. During creation, the analysis database uses at least one security template. If you choose to import more than one security template, the database will merge the various templates and create one composite template. It resolves conflicts in order of import; the last template that is imported takes precedence.

Viewing security analysis results

Security Configuration and Analysis displays the analysis results by security area, using visual flags to indicate problems. It displays the current system and base configuration settings for each security attribute in the security areas. To change the analysis database settings, right-click the entry and click Properties.

Visual Flag | Meaning
Red X | The entry is defined in the analysis database and on the system, but the security setting values do not match.
Green Check | The entry is defined in the analysis database and on the system and the setting values match.
Question Mark | The entry is not defined in the analysis database and, therefore, was not analyzed. If an entry is not analyzed, it may be that it was not defined in the analysis database or that the user who is running the analysis may not have sufficient permission to perform analysis on a specific object or area.
Exclamation point | This item is defined in the analysis database, but does not exist on the actual system. For example, there may be a restricted group that is defined in the analysis database but does not actually exist on the analyzed system.
No Highlight | The item is not defined in the analysis database or on the system.

If you choose to accept the current settings, the corresponding value in the base configuration is modified to match them. If you change the system setting to match the base configuration, the change will be reflected when you configure the system with Security Configuration and Analysis.

To avoid continued flagging of settings that you have investigated and determined to be reasonable, you can modify the base configuration. The changes are made to a copy of the template.

For more information, see To analyze system security, Resolving security discrepancies, and Security setting descriptions.


Resolving security discrepancies

You can resolve discrepancies between analysis database and system settings by:

  • Accepting or changing some or all of the values that are flagged or not included in the configuration, if you determine that the local system security levels are valid due to the context (or role) of that computer. These attribute values are then updated in the base and applied to the system when you choose Configure Computer Now. For more information, see To edit the analysis database.
  • Configuring the system to the analysis database values, if you determine the system is not in compliance with valid security levels. For more information, see To configure system security.
  • Importing a more appropriate template for the role of that computer into the database as the new base configuration and applying it to the system. For more information, see To import a security template to a database.

Changes to the analysis database are made to the stored template in the database, not to the security template file. The security template file will only be modified if you either return to Security Templates and edit that template or export the stored configuration to the same template file.

You should use Configure Computer Now only to modify security areas not affected by Group Policy settings, such as security on local files and folders, registry keys, and system services. Otherwise, when the Group Policy settings are applied, it will take precedence over local settings—such as account policies. In general, do not use Configure Computer Now when you are analyzing security for domain-based clients, since you will have to configure each client individually. In this case, you should return to Security Templates, modify the template, and reapply it to the appropriate Group Policy object.


Resources

The Microsoft Windows Resource Kits contain advanced information on how to configure, administer, optimize, and troubleshoot security features.

For information and the latest recommendations on Windows XP Professional security deployment and security tool set deployment information, see the Microsoft Security page on the Microsoft Web site (http://www.microsoft.com/).