Security setting descriptions

Computer Configuration\Windows Settings\Security Settings

Windows XP Service Pack 2 introduces some security-enhancing changes to security settings. To get the most up-to-date security setting descriptions, see "Changes to Functionality in Microsoft Windows XP Service Pack 2" on the Microsoft website (http://go.microsoft.com/fwlink/?LinkID=20969).

Security area | Description
Account Policies | Password Policy, Account Lockout Policy, and Kerberos Policy
Local Policies | Audit Policy, User Rights Assignment, and Security Options
Event Log | Application, system, and security Event Log settings
Restricted Groups | Membership of security-sensitive groups
System Services | Startup and permissions for system services
Registry | Permissions for registry keys
File System | Permissions for folders and files

You can configure the security settings that are described in this section on one computer, or on many computers, by using the Security Configuration Manager tools. The Security Configuration Manager tools consist of:

  • Security Templates
  • Security Configuration and Analysis
  • The Secedit.exe command-line tool
  • Local Security Policy
  • The Security Settings Extension to Group Policy

To set or to modify individual security settings on individual computers, use Local Security Policy. To define security settings that are enforced on any number of computers, use the Security Settings Extension to Group Policy. To apply several settings in a batch, use Security Templates to define the settings, and then apply those settings by using Security Configuration and Analysis or Secedit.exe, or import the template that contains your settings into Local Policy or Group Policy.

Note

  • For the most current information regarding Service Pack 2 for Microsoft Windows XP, see the page on the Microsoft website (http://www.microsoft.com/).


Account Policies

This section covers:

  • Password Policy
  • Account Lockout Policy
  • Kerberos Policy


Password Policy

This section covers:

  • Enforce password history
  • Maximum password age
  • Minimum password age
  • Minimum password length
  • Passwords must meet complexity requirements
  • Store password using reversible encryption for all users in the domain


Enforce password history

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

Description

Determines the number of unique new passwords that have to be associated with a user account before an old password can be reused. The value must be between 0 and 24 passwords.

This policy enables administrators to enhance security by ensuring that old passwords are not reused continually.

To maintain the effectiveness of the password history, do not allow passwords to be changed immediately when you configure the Minimum password age.

Default: 1.

For more information, see:

  • Security Configuration Manager Tools


Maximum password age

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

Description

Determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0.

Default: 42.


Minimum password age

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

Description

Determines the period of time (in days) that a password must be used before the user can change it. You can set a value between 1 and 999 days, or you can allow changes immediately by setting the number of days to 0.

The minimum password age must be less than the Maximum password age.

Configure the minimum password age to be more than 0 if you want Enforce password history to be effective. Without a minimum password age, users can cycle through passwords repeatedly until they get to an old favorite. The default setting does not follow this recommendation, so that an administrator can specify a password for a user and then require the user to change the administrator-defined password when the user logs on. If the password history is set to 0, the user does not have to choose a new password. For this reason, password history is set to 1 by default.

Default: 0.


Minimum password length

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

Description

Determines the least number of characters that a password for a user account may contain. You can set a value of between 1 and 14 characters, or you can establish that no password is required by setting the number of characters to 0.

Default: 0.


Password must meet complexity requirements

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

Description

Determines whether passwords must meet complexity requirements.

If this policy is enabled, passwords must meet the following minimum requirements:

  • Not contain all or part of the user's account name
  • Be at least six characters in length
  • Contain characters from three of the following four categories:
    • English uppercase characters (A through Z)
    • English lowercase characters (a through z)
    • Base 10 digits (0 through 9)
    • Nonalphanumeric characters (e.g., !, $, #, %)

Complexity requirements are enforced when passwords are changed or created.

To create custom password filters, see the Microsoft Platform Software Development Kit and the Microsoft Technet.

Default: Disabled.


Store password using reversible encryption for all users in the domain

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

Description

Determines whether Windows 2000 Server, Windows 2000 Professional, and Windows XP Professional store passwords using reversible encryption.

This policy provides support for applications that use protocols that require knowledge of the user's password for authentication purposes. Storing passwords using reversible encryption is essentially the same as storing plaintext versions of the passwords. For this reason, this policy should never be enabled unless application requirements outweigh the need to protect password information.

This policy is required when using CHAP authentication through remote access or IAS services. It is also required when using Digest Authentication in Internet Information Services (IIS).

Default: Disabled.


Account Lockout Policy

This section covers:

  • Account lockout duration
  • Account lockout threshold
  • Reset account lockout counter after


Account lockout duration

Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy

Description

Determines the number of minutes a locked-out account remains locked out before automatically becoming unlocked. The available range is 1 to 99,999 minutes. You can specify that the account will be locked out until an administrator explicitly unlocks it by setting the value to 0.

If an account lockout threshold is defined, the account lockout duration must be greater than or equal to the reset time.

Default: None, because this policy setting only has meaning when an Account lockout threshold is specified.


Account lockout threshold

Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy

Description

Determines the number of failed logon attempts that causes a user account to be locked out. A locked-out account cannot be used until it is reset by an administrator or until the lockout duration for the account has expired. You can set a value between 1 and 999 failed logon attempts, or you can specify that the account will never be locked out by setting the value to 0.

Failed password attempts against workstations or member servers that have been locked using either CTRL+ALT+DELETE or password-protected screen savers do not count as failed logon attempts.

Default: Disabled.


Reset account lockout counter after

Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy

Description

Determines the number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts. The available range is 1 minute to 99,999 minutes.

If an account lockout threshold is defined, this reset time must be less than or equal to the Account lockout duration.

Default: None, because this policy setting only has meaning when an Account lockout threshold is specified.


Kerberos Policy

This section covers:

  • Enforce user logon restrictions
  • Maximum lifetime for service ticket
  • Maximum lifetime for user ticket
  • Maximum lifetime for user ticket renewal
  • Maximum tolerance for computer clock synchronization


Enforce user logon restrictions

Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy

Description

Determines whether the Kerberos V5 Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. Validation of each request for a session ticket is optional, because the extra step takes time and it may slow network access to services.

When this policy is enabled, the user who requests the session ticket must have the right to Log on locally (if the requested service is running on the same computer) or the right to Access this computer from the network (if the requested service is on a remote computer) to receive a session ticket. If this policy is disabled, the check is not performed.

Default: Enabled.


Maximum lifetime for service ticket

Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy

Description

Determines the maximum amount of time (in minutes) that a granted session ticket can be used to access a particular service. The setting must be greater than 10 minutes and less than or equal to the setting for Maximum lifetime for user ticket.

If a client presents an expired session ticket when it requests a connection to a server, the server returns an error message. The client must request a new session ticket from the Kerberos V5 Key Distribution Center (KDC). Once a connection is authenticated, however, it no longer matters whether the session ticket remains valid. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket that is used to authenticate the connection expires during the connection.

Default: 600 minutes (10 hours).


Maximum lifetime for user ticket

Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy

Description

Determines the maximum amount of time (in hours) that a user's ticket-granting ticket (TGT) may be used. When a user's TGT expires, a new one must be requested or the existing one must be "renewed."

Default: 10 hours.


Maximum lifetime for user ticket renewal

Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy

Description

Determines the period of time (in days) during which a user's ticket-granting ticket (TGT) may be renewed.

Default: 7 days.


Maximum tolerance for computer clock synchronization

Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy

Description

Determines the maximum time difference (in minutes) that Kerberos V5 tolerates between the time on a client's clock and the time on a server's clock while still considering the two clocks to be synchronous.

To prevent "replay attacks," Kerberos V5 uses time stamps as part of its protocol definition. For time stamps to work properly, the clocks of the client and the server need to be in sync as much as possible. In other words, both computers must be set to the same time and date. Because the clocks of two computers are often out of sync, administrators can use this policy to establish the maximum acceptable difference to Kerberos V5 between a client's clock and server's clock. If the difference between a client's clock and the server's clock is less than the maximum time difference that is specified in this policy, any time stamp that is used in a session between the two computers is considered to be authentic.

Default: 5 minutes.


Local Policies

This section covers:

  • Audit Policy
  • User Rights Assignment
  • Security Options


Audit Policy

This section covers:

  • Audit account logon events
  • Audit account management
  • Audit directory service access
  • Audit logon events
  • Audit object access
  • Audit policy change
  • Audit privilege use
  • Audit process tracking
  • Audit system events


Audit account logon events

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit each instance of a user logging on to or logging off from another computer in which this computer is used to validate the account.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when an account logon attempt succeeds. Failure audits generate an audit entry when an account logon attempt fails. To set this value to no auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

If success auditing for account logon events is enabled on a domain controller, an entry is logged for each user who is validated against that domain controller, even though the user is actually logging on to a workstation that is joined to the domain.

Default:

  • No auditing for domain controllers.
  • Undefined for a member computer.

For more information, see:

  • Audit logon events


Audit account management

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit each event of account management on a computer. Examples of account management events include the following:

  • A user account or group is created, changed, or deleted.
  • A user account is renamed, disabled, or enabled.
  • A password is set or changed.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when any account management event succeeds. Failure audits generate an audit entry when any account management event fails. To set this value to no auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

Default: No auditing.


Audit directory service access

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified.

By default, this value is set to no auditing in the Default Domain Controller Group Policy object (GPO), and it remains undefined for workstations and servers where it has no meaning.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a user successfully accesses an Active Directory object that has a SACL specified. Failure audits generate an audit entry when a user unsuccessfully attempts to access an Active Directory object that has a SACL specified. To set this value to no auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

Note that you can set a SACL on an Active Directory object by using the Security tab in that object's Properties dialog box. This is the same as Audit object access, except that it applies only to Active Directory objects and not to file system and registry objects.

Default:

  • No auditing for domain controllers.
  • Undefined for a member computer.


Audit logon events

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit each instance of a user logging on to, logging off from, or making a network connection to this computer.

If you are logging successful Audit account logon events on a domain controller, workstation logon attempts do not generate logon audits. Only interactive and network logon attempts to the domain controller itself generate logon events. In short, "account logon events" are generated where the account lives; "logon events" are generated where the logon attempt occurs.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a logon attempt succeeds. Failure audits generate an audit entry when a logon attempt fails. To set this value to no auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

Default: No auditing.


Audit object access

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit the event of a user accessing an object—for example, a file, folder, registry key, printer, and so forth—that has its own system access control list (SACL) specified.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a user successfully accesses an object that has a SACL specified. Failure audits generate an audit entry when a user unsuccessfully attempts to access an object that has a SACL specified. To set this value to no auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

Note that you can set a SACL on a file system object using the Security tab in that object's Properties dialog box.

Default: No auditing.

For more information, see:

  • Audit directory service access


Audit policy change

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit every incidence of a change to user rights assignment policies, audit policies, or trust policies.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a change to user rights assignment policies, audit policies, or trust policies is successful. Failure audits generate an audit entry when a change to user rights assignment policies, audit policies, or trust policies fails. To set this value to no auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

Default: No auditing.


Audit privilege use

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit each instance of a user exercising a user right.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when the exercise of a user right succeeds. Failure audits generate an audit entry when the exercise of a user right fails. To set this value to no auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

Default: Audits are not generated for use of the following user rights, even if success audits or failure audits are specified for "Audit privilege use":

  • Bypass traverse checking
  • Debug programs
  • Create a token object
  • Replace process level token
  • Generate security audits
  • Back up files and directories
  • Restore files and directories


Audit process tracking

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when the process being tracked succeeds. Failure audits generate an audit entry when the process being tracked fails. To set this value to no auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

Default: No auditing.


Audit system events

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a system event is executed successfully. Failure audits generate an audit entry when a system event is attempted unsuccessfully. To set this value to no auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

Default: No auditing.


User Rights Assignment

This section covers:

  • Access this computer from the network
  • Act as part of the operating system
  • Add workstations to domain
  • Adjust memory quotas for a process
  • Allow logon through terminal services
  • Back up files and directories
  • Bypass traverse checking
  • Change the system time
  • Create a pagefile
  • Create a token object
  • Create permanent shared objects
  • Debug programs
  • Deny access to this computer from the network
  • Deny logon as a batch job
  • Deny logon as a service
  • Deny logon locally
  • Deny logon through Terminal Services
  • Enable computer and user accounts to be trusted for delegation
  • Force shutdown from a remote system
  • Generate security audits
  • Increase scheduling priority
  • Load and unload device drivers
  • Lock pages in memory
  • Log on as a batch job
  • Log on as a service
  • Log on locally
  • Manage auditing and security log
  • Modify firmware environment values
  • Perform volume maintenance tasks
  • Profile single process
  • Profile system performance
  • Remove computer from docking station
  • Replace a process level token
  • Restore files and directories
  • Shut down the system
  • Synchronize directory service data
  • Take ownership of files or other objects


Access this computer from the network

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users and groups are allowed to connect to the computer over the network.

Important

  • Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Access this computer from network (http://go.microsoft.com/fwlink/?LinkId=24267) at the Microsoft website.

Default:

  • On workstations and servers:
    • Administrators
    • Backup Operators
    • Power Users
    • Users
    • Everyone
  • On domain controllers:
    • Administrators
    • Authenticated Users
    • Everyone


Act as part of the operating system

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

This policy allows a process to authenticate as any user, and therefore gain access to the same resources as any user. Only low-level authentication services should require this privilege.

Potential access is not limited to the default user associations, because the calling process might request that arbitrary additional access permissions be put in the access token. A greater concern is that the calling process can build an anonymous token that can provide any and all access permissions. In addition, the anonymous token does not provide a primary identity for tracking events in the audit log.

Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned.

Default: Local System.


Add workstations to domain

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which groups or users can add workstations to a domain.

This policy is valid only on domain controllers. By default, any authenticated user has this right and can create up to 10 computer accounts in the domain.

Adding a computer account to the domain allows the computer to participate in Active Directory–based networking. For example, adding a workstation to a domain enables that workstation to recognize accounts and groups that exist in Active Directory.

Default: Authenticated Users.

Note

  • Users who have the Create Computer Objects permission on the Active Directory computers container can also create computer accounts in the domain. The distinction is that users with permissions on the container are not restricted to the creation of only 10 computer accounts. In addition, computer accounts that are created by means of "Add workstations to domain" have Domain Administrators as the owner of the computer account, while computer accounts that are created by means of permissions on the computers container have the creator as the owner of the computer account. If a user has permissions on the container and also has the "Add workstations to domain" user right, the computer is added, based on the computer container permissions rather than on the user right.


Adjust memory quotas for a process

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which accounts can use a process with Write Property access to another process to increase the processor quota assigned to the other process.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

Default: Administrators.

Note

  • This privilege is useful for system tuning, but it can be misused, for example, in a denial-of-service attack.


Allow logon through Terminal Services

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users or groups have permission to log on as a Terminal Services client.

Default:

  • On workstation and servers: Administrators, Remote Desktop Users.
  • On domain controllers: Administrators.

Important

  • This setting does not have any effect on Windows 2000 computers that have not been updated to Service Pack 2.

For more information, see:

  • Deny logon through terminal services


Back up files and directories

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can circumvent file and directory permissions for the purposes of backing up the system.

Specifically, this privilege is similar to granting the following permissions to the user or group in question on all files and folders on the system:

  • Traverse Folder/Execute File
  • List Folder/Read Data
  • Read Attributes
  • Read Extended Attributes
  • Read Permissions

Default: Administrators and Backup Operators.

For more information, see:

  • Restore files and directories


Bypass traverse checking

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

Default:

  • On workstations and servers:
    • Administrators
    • Backup Operators
    • Power Users
    • Users
    • Everyone
  • On domain controllers:
    • Administrators
    • Authenticated Users


Change the system time

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users and groups can change the time and date on the internal clock of the computer.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

Default:

  • On workstations and servers:
    • Administrators
    • Power Users
  • On domain controllers:
    • Administrators
    • Server Operators


Create a pagefile

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users and groups can create and change the size of a pagefile. You can create a pagefile by specifying a paging file size for a given drive in System Properties Performance Options.

Default: Administrators.


Create a token object

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs.

It is recommended that processes requiring this privilege use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned.

Default: Local System.


Create permanent shared objects

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which accounts can be used by processes to create a directory object in the Windows 2000 Server, Windows 2000 Professional, and Windows XP Professional object manager.

This privilege is useful to kernel-mode components that extend the Windows 2000 Server, Windows 2000 Professional, and Windows XP Professional 0 object namespace. Because components that are running in kernel mode already have this privilege assigned to them, it is not necessary to specifically assign it.

Default: Local System.


Debug programs

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can attach a debugger to any process. This privilege provides powerful access to sensitive and critical operating system components.

Default:

  • Administrators
  • Local System


Deny access to this computer from the network

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users are prevented from accessing a computer over the network. This policy setting supersedes the Access this computer from the network policy setting if a user account is subject to both policies.

Default:

  • On workstations and servers:
    • Administrators
    • Backup Operators
    • Power Users
    • Users
    • Everyone
  • On domain controllers:
    • Administrators
    • Authenticated Users
    • Everyone


Deny logon as a batch job

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which accounts are prevented from being able to log on as a batch job. This policy setting supersedes the Log on as a batch job policy setting if a user account is subject to both policies.

Default: None.


Deny logon as a service

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which service accounts are prevented from registering a process as a service. This policy setting supersedes the Log on as a service policy setting if an account is subject to both policies.

Default: None.


Deny logon locally

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users are prevented from logging on at the computer. This policy setting supersedes the Log on locally policy setting if an account is subject to both policies.

Default: None.


Deny logon through Terminal Services

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users and groups are prohibited from logging on as a Terminal Services client.

Default: None.

Important

  • This setting does not have any effect on Windows 2000 computers that have not been updated to Service Pack 2.

For more information, see:

  • Allow logon through terminal services


Enable computer and user accounts to be trusted for delegation

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can set the Trusted for Delegation setting on a user or computer object.

The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using a client's delegated credentials, as long as the client's account does not have the Account cannot be delegated account control flag set.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

Default: Administrators on domain controllers.

Note

  • Misuse of this privilege, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources.


Force shutdown from a remote system

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users are allowed to shut down a computer from a remote location on the network.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

Default:

  • On workstations and servers: Administrators.
  • On domain controllers: Administrators, Server Operators.

For more information, see:

  • Shut down the system


Generate security audits

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which accounts can be used by a process to add entries to the security log. The security log is used to trace unauthorized system access.

Default: Local System.

For more information, see:

  • Manage auditing and security log


Increase scheduling priority

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which accounts can use a process with Write Property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface.

Default: Administrators.


Load and unload device drivers

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can dynamically load and unload device drivers. This privilege is necessary for installing drivers for Plug and Play devices.

Default: Administrators.


Lock pages in memory

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

This policy determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM).

Default: None.


Log on as a batch job

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Allows a user to be logged on by means of a batch-queue facility.

For example, when a user submits a job by means of the task scheduler, the task scheduler logs that user on as a batch user rather than as an interactive user.

Default: Local System.

Note

  • In Windows 2000 Server, Windows 2000 Professional, and Windows XP Professional, the Task Scheduler automatically grants this right as necessary.

For more information, see:

  • Deny logon as a batch job


Log on as a service

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which service accounts can register a process as a service.

Default: None.

For more information, see:

  • Deny logon as a service.


Log on locally

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can log on to the computer.

Important

  • Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (http://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website.

Default:

  • On workstations and servers: Administrators, Backup Operators, Power Users, Users, and Guest.
  • On domain controllers: Account Operators, Administrators, Backup Operators, and Print Operators.

For more information, see:

  • Deny logon locally


Manage auditing and security log

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys.

This policy does not allow a user to enable file and object access auditing in general. For such auditing to be enabled, the Audit object access setting in Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policies must be configured.

You can view audited events in the security log of the Event Viewer. A user with this privilege can also view and clear the security log.

Default: Administrators.


Modify firmware environment values

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which security groups can modify system-wide environment values.

Default: Administrators, Local System.


Perform volume maintenance tasks

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Determines which users and groups have the authority to run volume maintenance tasks, such as Disk Cleanup and Disk Defragmenter.

Default: Administrators.


Profile single process

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can use performance monitoring tools to monitor the performance of nonsystem processes.

Default: Administrators, Local System.

For more information, see:

  • Profile system performance


Profile system performance

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can use performance monitoring tools to monitor the performance of system processes.

Default: Administrators, Local System.

For more information, see:

  • Profile single process


Remove computer from docking station

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines whether a user can undock a portable computer from its docking station without logging on.

If this policy is enabled, the user must log on before removing the portable computer from its docking station. If this policy is disabled, the user may remove the portable computer from its docking station without logging on.

Default: Disabled.


Replace a process level token

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which user accounts can initiate a process to replace the default token associated with a started subprocess.

Default: Local System.


Restore files and directories

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can circumvent file and directory permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object.

Default:

  • Workstations and servers: Administrators, Backup Operators.
  • Domain controllers: Administrators, Backup Operators, Server Operators.

For more information, see:

  • Back up files and directories


Shut down the system

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users who are logged on locally to the computer can shut down the operating system using the Shut Down command.

Default:

  • Workstations and servers: Administrators, Backup Operators, Power Users, Users.
  • Domain controllers: Account Operators, Administrators, Backup Operators, Server Operators, Print Operators.

For more information, see:

  • Force shutdown from a remote system


Synchronize directory service data

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users and groups have the authority to synchronize directory service data. This is also known as Active Directory synchronization.

Defaults: None.


Take ownership of files or other objects

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads.

Default: Administrators.


Security options

This section covers:

  • Accounts: Administrator account status
  • Accounts: Guest account status
  • Accounts: Limit local account use of blank passwords to console logon only
  • Accounts: Rename administrator account
  • Accounts: Rename guest account
  • Audit: Audit the access of global system objects
  • Audit: Audit use of Backup and Restore privilege
  • Audit: Shut down system immediately if unable to log security audits
  • Devices: Allowed to format and eject removable media
  • Devices: Allow undock without having to logon
  • Devices: Prevent users from installing printer drivers
  • Devices: Restrict CD-ROM access to locally logged-on user only
  • Devices: Restrict floppy access to locally logged-on user only
  • Devices: Unassigned driver installation behavior
  • Domain controller: Allow server operators to schedule tasks (domain controllers only)
  • Domain controller: Refuse machine account password changes
  • Domain member: Digitally encrypt or sign secure channel data (always)
  • Domain member: Digitally encrypt secure channel data (when possible)
  • Domain member: Digitally sign secure channel data (when possible)
  • Domain member: Maximum age for machine account password
  • Domain member: Require strong (Windows 2000 or later) session key
  • Domain member: Disable machine account password changes
  • Interactive logon: Do not display last user name
  • Interactive logon: Do not require CTRL+ALT+DEL
  • Interactive logon: Message text for users attempting to log on
  • Interactive logon: Message title for users attempting to log on
  • Interactive logon: Number of previous logons to cache (in case domain controller is not available)
  • Interactive logon: Prompt user to change password before expiration
  • Interactive logon: Require domain controller authentication to unlock
  • Interactive logon: Smart card removal behavior
  • Microsoft network client: Digitally sign communications (always)
  • Microsoft network client: Digitally sign communications (if server agrees)
  • Microsoft network client: Send unencrypted password to connect to third-party SMB servers
  • Microsoft network server: Amount of idle time required before suspending a session
  • Microsoft network server: Digitally sign communications (always)
  • Microsoft network server: Digitally sign communications (if client agrees)
  • Microsoft network server: Disconnect clients when logon time expires
  • Network access: Allow anonymous SID/name translation
  • Network access: Do not allow anonymous enumeration of SAM accounts
  • Network access: Do not allow anonymous enumeration of SAM accounts and shares
  • Network access: Do not allow Stored User Names and Passwords to save passwords or credentials for domain authentication
  • Network access: Let Everyone permissions apply to anonymous users
  • Network access: Named pipes that can be accessed anonymously
  • Network access: Remote Remotely accessible registry paths
  • Network access: Shares that can be accessed anonymously
  • Network access: Sharing and security model for local accounts
  • Network security: Do not store Lan Manager level hash values on next password change
  • Network security: Force logoff when logon hours expire
  • Network security: LAN Manager Authentication Level
  • Network security: Minimum session security for NTLM SSP based (including RPC) clients
  • Network security: Minimum session security for NTLM SSP based (including RPC) servers
  • Recovery console: Allow automatic administrative logon
  • Recovery console: Allow floppy copy and access to all drives and all folders
  • Shutdown: Allow system to be shut down without having to log on
  • Shutdown: Clear virtual memory pagefile
  • System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing
  • System objects: Default owner for objects created by members of the administrators group
  • System objects: Require case insensitivity for non-Windows subsystems
  • System objects: Strengthen default permissions of global system objects (e.g., Symbolic links)


Accounts: Administrator account status

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the Administrator account is enabled or disabled under normal operation. Under safe mode boot, the Administrator account is always enabled, regardless of this setting.

Default: Enabled.

Notes

  • If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must set the password on the Administrator account by using the Local Users and Groups user interface.
  • Disabling the Administrator account can become a maintenance issue under certain circumstances. For example, in a domain environment, if the secure channel that constitutes your join fails for any reason, and there is no other local Administrator account, you must restart in safe mode to fix the problem that is causing your join status to be broken.


Accounts: Guest account status

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines if the Guest account is enabled or disabled.

Default: Disabled.

Note

  • If the Guest account is disabled and the security option "Network Access: Sharing and Security Model" is set to "Guest Only," network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail.


Accounts: Limit local account use of blank passwords to console logon only

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether remote interactive logons by network services such as Terminal Services, Telnet, and FTP are allowed for local accounts that have blank passwords. If this setting is enabled, a local account must have a nonblank password to be used to perform an interactive logon from a remote client.

Default: Enabled

Notes

  • This setting does not affect interactive logons that are performed physically at the console.
  • This setting does not affect logons that use domain accounts.
  • It is possible for applications that use remote interactive logons to bypass this setting.


Accounts: Rename administrator account

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether a different account name is associated with the security identifier (SID) for the account "Administrator." Because the Administrator account is known to exist on all Windows 2000 Server, Windows 2000 Professional, and Windows XP Professional computers, renaming the account makes it slightly more difficult for unauthorized persons to guess this privileged user name and password combination.

Default: Administrator.


Accounts: Rename guest account

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether a different account name is associated with the security identifier (SID) for the account "Guest." Because the Guest account is known to exist on all Windows 2000 Server, Windows 2000 Professional, and Windows XP Professional computers, renaming the account makes it slightly more difficult for unauthorized persons to guess this user name and password combination.

Default: Guest.


Audit: Audit the access of global system objects

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether to audit the access of global system objects.

If this policy is enabled, it causes system objects, such as mutexes, events, semaphores, and DOS devices, to be created with a default system access control list (SACL). If the Audit object access audit policy is also enabled, access to these system objects is audited.

Default: Disabled.


Audit: Audit the use of Backup and Restore privilege

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether to audit the use of all user privileges, including Backup and Restore, when the Audit privilege use policy is in effect. Enabling this option when the "Audit privilege use" policy is also enabled generates an audit event for every file that is backed up or restored.

If you enable this policy, and if the "Audit privilege use" policy is enabled and in effect, any instance of user rights being exercised is recorded in the security log.

If you disable this policy, when users use Backup or Restore privileges, those events are not audited, even when "Audit privilege use" is enabled.

Default: Disabled.


Audit: Shut down system immediately if unable to log security audits

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the system shuts down if it is unable to log security events.

If this policy is enabled, it causes the system to stop if a security audit cannot be logged for any reason. Typically, an event fails to be logged when the security audit log is full and the retention method that is specified for the security log is either "Do Not Overwrite Events" or "Overwrite Events by Days."

If the security log is full and an existing entry cannot be overwritten, and this security option is enabled, the following Stop error appears:

STOP: C0000244 {Audit Failed}
An attempt to generate a security audit failed.

To recover, an administrator must log on, archive the log (optional), clear the log, and reset this option as desired.

Default: Disabled.


Devices: Allow undock without having to log on

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether a user must log on to request that a portable computer be removed from a docking station. If this setting is disabled, the user must log on to request an undock, at which time the user must have been granted the Remove Computer from Docking Station privilege. If this setting is enabled, a user can request an undock by pressing the portable computer's physical eject button.

Default: Enabled.

Note

  • This setting should only be disabled for portable computers that cannot be mechanically undocked. Otherwise, a user can physically remove the computer when he or she cannot log in and the eject button does not work.


Devices: Allowed to format and eject removable media

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines who is allowed to format and eject removable NTFS media. This capability can be given to Administrators, Administrators and Power Users, or Administrators and Interactive Users.

Default: Administrators.


Devices: Prevent users from installing printer drivers

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

For a computer to print to a network printer, the driver for that network printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of adding a network printer. If this setting is enabled, only Administrators and Power Users can install a printer driver as part of adding a network printer. If this setting is disabled, any user can install a printer driver as part of adding a network printer. This setting can be used to prevent unprivileged users from downloading and installing an untrusted printer driver.

Default:

  • Enabled on servers.
  • Disabled on workstations.

Notes

  • If an administrator has configured a trusted path for downloading drivers, this setting has no impact. When trusted paths are used, the print subsystem attempts to use the trusted path to download the driver. If the trusted path download succeeds, the driver is installed on behalf of any user. If the trusted path download fails, the driver is not installed and the network printer cannot be added.
  • If this setting is enabled, but the driver for a network printer already exists on the local machine, users can still add the network printer.
  • This setting does not affect the ability to add a local printer.


Devices: Restrict CD-ROM access to locally logged-on user only

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether a CD-ROM is accessible to both local and remote users simultaneously.

If this policy is enabled, it allows only the interactively logged-on user to access removable CD-ROM media. If this policy is enabled and no one is logged on interactively, the CD-ROM can be accessed over the network.

Default: Disabled.


Devices: Restrict floppy access to locally logged-on user only

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether removable floppy media are accessible to both local and remote users simultaneously.

If this policy is enabled, it allows only the interactively logged-on user to access removable floppy media. If this policy is enabled and no one is logged on interactively, the floppy can be accessed over the network.

Default: Disabled.


Devices: Unsigned driver installation behavior

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines what happens when an attempt is made to install a device driver (by means of Setup API) that has not been certified by the Windows Hardware Quality Lab (WHQL).

The options are:

  • Silently succeed
  • Warn but allow installation
  • Do not allow installation

Default: Warn but allow installation.


Domain controller: Allow server operators to schedule tasks

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines if Server Operators are allowed to submit jobs by means of the AT schedule facility.

Default: This policy is not defined, which means that the system treats it as disabled.

Note

  • This security option only affects the AT schedule facility; it does not affect the Task Scheduler facility.


Domain controller: Refuse machine account password changes

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether or not a Domain Controller will accept password change requests for computer accounts. If enabled on all Domain Controllers in a domain, then domain members will not be able to change their machine account passwords leaving those passwords susceptible to attack.

Default: Disabled.


Domain member: Digitally encrypt or sign secure channel data (always)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether a secure channel can be established with a domain controller that is not capable of signing or encrypting all secure channel traffic. If this setting is enabled, a secure channel cannot be established with any domain controller that cannot sign or encrypt all secure channel data. If this setting is disabled, a secure channel can be established, but the level of encryption and signing is negotiated.

Default: Disabled.

Important

  • For you to enable this setting on a member workstation or server, all domain controllers in the domain that the member belongs to must be capable of signing or encrypting all secure channel data. This means that all such domain controllers must be running Windows NT 4.0 with Service Pack 4 or higher.
  • For you to enable this setting on a domain controller, all domain controllers in all trusting and trusted domains must be capable of signing or encrypting all secure channel data. This means that all such domain controllers must be running Windows NT 4.0 with Service Pack 4 or higher.
  • If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is automatically enabled.


Domain member: Digitally encrypt secure channel data (when possible)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

If this setting is enabled, it ensures that all secure channel traffic is encrypted if the partner domain controller is also capable of encrypting all secure channel traffic.

Default: Enabled.

Important

  • There is no known reason for disabling this setting. Besides unnecessarily reducing the potential confidentiality level of the secure channel, disabling this setting may unnecessarily reduce secure channel throughput, because concurrent API calls that use the secure channel are only possible when the secure channel is signed or encrypted.


Domain member: Digitally sign secure channel data (when possible)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

If this setting is enabled, it ensures that all secure channel traffic is signed if the partner domain controller is also capable of signing all secure channel traffic.

Default: Enabled.

Important

  • There is no known reason for disabling this setting. Besides unnecessarily reducing the potential integrity level of the secure channel, disabling this setting may unnecessarily reduce secure channel throughput, because concurrent API calls that use the secure channel are only possible when the secure channel is signed or encrypted.
  • If the policy Domain member: Digitally encrypt secure channel data (when possible) is enabled, this setting is implicitly enabled.


Domain member: Maximum machine account password age

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines the maximum allowable age for a computer account password.

Default: 30 days.

Important

  • This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers.


Domain member: Require strong (Windows 2000 or later) session key

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether a secure channel can be established with a domain controller that is not capable of encrypting secure channel traffic with a strong (128-bit) session key. If this setting is enabled, a secure channel is not established with any domain controller that cannot encrypt secure channel data with a strong key. If this setting is disabled, 64-bit session keys are tolerated.

Default: Disabled.

Important

  • To enable this setting on a member workstation or server, all domain controllers in the domain that the member belongs to must be capable of encrypting secure channel data with a strong (128-bit) key. This means that all such domain controllers must be running Windows 2000.
  • To enable this setting on a domain controller, all domain controllers in all trusting and trusted domains must be capable of encrypting secure channel data with a strong (128-bit) key. This means that all such domain controllers must be running Windows 2000.


Domain member: Disable machine account password changes

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for "Domain Member: Maximum age for machine account password," which by default is every 30 days.

Default: Disabled.

Notes

  • This setting should not be enabled. Computer account passwords are used to establish secure channel communications between members and domain controllers and, within the domain, between the domain controllers themselves. Once it is established, the secure channel is used to transmit sensitive information that is necessary for making authentication and authorization decisions.
  • This setting should not be used in an attempt to support dual-boot scenarios that use the same computer account. If you want to dual-boot two installations that are joined to the same domain, give the two installations different computer names.


Interactive logon: Do not display last user name

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the name of the last user to log on to the computer is displayed in the Windows logon screen.

If this policy is enabled, the name of the last user to successfully log on is not displayed in the Log On to Windows dialog box.

If this policy is disabled, the name of the last user to log on is displayed.

Default: Disabled.


Interactive logon: Do not require CTRL+ALT+DEL

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether pressing CTRL+ALT+DEL is required before a user can log on.

If this policy is enabled on a computer, a user is not required to press CTRL+ALT+DEL to log on. Not having to press CTRL+ALT+DEL leaves users susceptible to attacks that attempt to intercept the users' passwords. Requiring CTRL+ALT+DEL before users log on ensures that users are communicating by means of a trusted path when entering their passwords.

If this policy is disabled, any user is required to press CTRL+ALT+DEL before logging on to Windows (unless they are using a smart card for Windows logon).

Default:

  • Disabled on workstations and servers that are joined to a domain.
  • Enabled on stand-alone workstations.


Interactive logon: Message text for users attempting to log on

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Specifies a text message that is displayed to users when they log on.

This text is often used for legal reasons, for example, to warn users about the ramifications of misusing company information or to warn them that their actions may be audited.

Default: No message.

Caution

  • Windows XP Professional adds support for configuring logon banners that can exceed 512 characters in length and that can also contain carriage-return line-feed sequences. However, Windows 2000 clients cannot interpret and display message text that is created by Windows XP Professional computers. You must use a Windows 2000 computer to create a logon message policy that applies to Windows 2000 computers. If you inadvertently create a logon message policy using a Windows XP Professional computer, and you discover that it does not display properly on Windows 2000 computers, do the following:
    • Undefine the setting.
    • Redefine the setting using a Windows 2000 computer
      • .

    Simply changing a Windows XP Professional-defined logon message policy using a Windows 2000 computer does not work. The setting must be undefined first.

For more information, see:

  • Interactive logon: Message title for users attempting to log on


Interactive logon: Message title for users attempting to log on

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Allows the specification of a title to appear in the title bar of the window that contains the Interactive logon: Message text for users attempting to log on.

Default: No message.


Interactive logon: Number of previous logons to cache (in case domain controller is not available)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines the number of times a user can log on to a Windows domain using cached account information.

Logon information for domain accounts can be cached locally so that, in the event a domain controller cannot be contacted on subsequent logons, a user can still log on. This setting determines the number of unique users for which logon information is cached locally.

If a domain controller is unavailable and a user's logon information is cached, the user is prompted with the following message:

A domain controller for your domain could not be contacted. You have been logged on using cached account information. Changes to your profile since you last logged on may not be available.

If a domain controller is unavailable and a user's logon information is not cached, the user is prompted with this message:

The system cannot log you on now because the domain <DOMAIN_NAME> is not available.

Default: 10.

Notes

  • Setting this value to 0 disables the local caching of logon information.
  • The maximum value for this setting is 50.


Interactive logon: Prompt user to change password before expiration

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines how far in advance (in days) users are warned that their password is about to expire. With this advance warning, the user has time to construct a password that is sufficiently strong.

Default: 14 days.


Interactive logon: Require Domain Controller authentication to unlock

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Logon information must be provided to unlock a locked computer. For domain accounts, this setting determines whether a domain controller must be contacted to unlock a computer. If this setting is disabled, a user can unlock the computer using cached credentials. If this setting is enabled, a domain controller must authenticate the domain account that is being used to unlock the computer.

Default: Disabled.

Important

  • This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers.


Interactive logon: Smart card removal behavior

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines what happens when the smart card for a logged-on user is removed from the smart card reader.

The options are:

  • No Action
  • Lock Workstation
  • Force Logoff

If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session.

If you click Force Logoff in the Properties dialog box for this policy, the user is automatically logged off when the smart card is removed.

Default: No action specified.


Microsoft network client: Digitally sign communications (always)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the computer always digitally signs client communications.

The Windows 2000 Server, Windows 2000 Professional, and Windows XP Professional authentication protocol Server Message Block (SMB) supports mutual authentication, which closes a "man-in-the-middle" attack and supports message authentication, which prevents active message attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by both the client and the server.

To use SMB signing, you must either enable it or require it on both the SMB client and the SMB server. If SMB signing is enabled on a server, clients that are also enabled for SMB signing use the packet signing protocol during all subsequent sessions. If SMB signing is required on a server, a client is not able to establish a session, unless it is at least enabled for SMB signing.

If this policy is enabled, it requires the SMB client to sign packets. If this policy is disabled, it does not require the SMB client to sign packets.

Important

  • Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Microsoft network client: Digitally sign communications (always) (http://go.microsoft.com/fwlink/?LinkId=24274) at the Microsoft website.

Default: Disabled

Note

  • SMB signing imposes a performance penalty on your system. Although it does not consume any more network bandwidth, it does use more CPU cycles on the client and server side.


Microsoft network client: Digitally sign communications (if server agrees)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

If this policy is enabled, it causes the Server Message Block (SMB) client to perform SMB packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing.

Default: Enabled.

For more information, see:

  • Microsoft network client: Digitally sign communications (always) for more details about using digital signatures in client/server communications


Microsoft network client: Send unencrypted password to connect to third-party SMB servers

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

If this policy is enabled, the Server Message Block (SMB) redirector is allowed to send plaintext passwords to non-Microsoft SMB servers that do not support password encryption during authentication.

Default: Disabled.


Microsoft network server: Amount of idle time required before suspending session

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines the amount of continuous idle time that must pass in a Server Message Block (SMB) session before the session is suspended due to inactivity.

Administrators can use this policy to control when a computer suspends an inactive SMB session. If client activity resumes, the session is automatically reestablished.

For this policy setting, a value of 0 means to disconnect an idle session as quickly as is reasonably possible. The maximum value is 99999, which is 208 days; in effect, this value disables the policy.

Default:

  • 15 minutes for servers.
  • Undefined for workstations.


Microsoft network server: Digitally sign communications (always)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

If this policy is enabled, it requires the Server Message Block (SMB) server to perform SMB packet signing.

Important

  • Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Microsoft network server: Digitally sign communications (always) (http://go.microsoft.com/fwlink/?LinkId=24275) at the Microsoft website.

Default: Disabled.

For more information, see:

  • Microsoft network client: Digitally sign communications (always) for more details about using digital signatures in client/server communications
  • Microsoft network server: Digitally sign communications (if client agrees)


Microsoft network server: Digitally sign communications (if client agrees)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

If this policy is enabled, it causes the Server Message Block (SMB) server to perform SMB packet signing.

Default:

  • Disabled on workstations.
  • Enabled on servers.

For more information, see:

  • Microsoft network client: Digitally sign communications (always)
  • Microsoft network server: Digitally sign communications (always)


Microsoft network server: Disconnect clients when logon hours expire

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether to disconnect users who are connected to the local computer outside their user account's valid logon hours. This setting affects the Server Message Block (SMB) component.

When this policy is enabled, it causes client sessions with the SMB Service to be forcibly disconnected when the client's logon hours expire.

If this policy is disabled, an established client session is allowed to be maintained after the client's logon hours have expired.

Default: Undefined.

For more information, see:

  • Set logon hours


Network access: Allow anonymous SID/Name translation

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines if an anonymous user can request security identifier (SID) attributes for another user.

If this policy is enabled, a user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name.

Default:

  • Disabled on workstations.
  • Enabled on server.

Important

  • Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Network access: Allow anonymous SID/Name translation (http://go.microsoft.com/fwlink/?LinkId=24276) at the Microsoft website.

Note

  • For domain accounts, there can be only one account policy. The account policy must be defined in the Default Domain Policy, and it is enforced by the domain controllers that make up the domain. A domain controller always pulls the account policy from the Default Domain Policy Group Policy object (GPO), even if there is a different account policy applied to the organizational unit that contains the domain controller. By default, workstations and servers that are joined to a domain (i.e., member computers) also receive the same account policy for their local accounts. However, local account policies for member computers can be different from the domain account policy by defining an account policy for the organizational unit that contains the member computers. Kerberos settings are not applied to member computers.


Network access: Do not allow anonymous enumeration of SAM accounts

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines what additional permissions will be granted for anonymous connections to the computer.

Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. By default, an anonymous user has the same access that is granted to the Everyone group for a given resource.

This security option allows additional restrictions to be placed on anonymous connections as follows:

  • None. Rely on default permissions.
  • Do not allow enumeration of SAM accounts. This option replaces "Everyone" with "Authenticated Users" in the security permissions for resources.

Default:

  • Enabled on workstation.
  • Disabled on server.

Important

  • This policy has no impact on domain controllers.

For more information, see:

  • Network access: Let Everyone permissions apply to anonymous users


Network access: Do not allow anonymous enumeration of SAM accounts and shares

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether anonymous enumeration of SAM accounts and shares is allowed.

Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. If you do not want to allow anonymous enumeration of SAM accounts and shares, then enable this policy.

Important

  • Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Network access: Do not allow anonymous enumeration of SAM accounts (http://go.microsoft.com/fwlink/?LinkId=24277) at the Microsoft website.

Default: Disabled.

For more information, see:

  • Network access: Let Everyone permissions apply to anonymous users


Network access: Do not allow Stored User Names and Passwords to save passwords or credentials for domain authentication

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the Stored User Names and Passwords saves passwords or credentials for later use when it gains domain authentication.

If it is enabled, this setting prevents the Stored User Names and Passwords from storing passwords and credentials.

Default: Disabled.


Network access: Let Everyone permissions apply to anonymous users

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines what additional permissions are granted for anonymous connections to the computer.

Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. By Default, the Everyone security identifier (SID) is removed from the token created for anonymous connections. Therefore, permissions granted to the Everyone group do not apply to anonymous users. If this option is set, anonymous users can only access those resources for which the anonymous user has been explicitly given permission.

If this policy is enabled, the Everyone SID is added to the token that is created for anonymous connections. In this case, anonymous users are able to access any resource for which the Everyone group has been given permissions.

Default: Disabled.

For more information, see:

  • Network access: Do not allow anonymous enumeration of SAM accounts and shares


Network access: Named Pipes that can be accessed anonymously

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines which communication sessions (pipes) will have attributes and permissions that allow anonymous access.

Default: None.


Network access: Remotely accessible registry paths

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines registry paths will be accessible for referencing the winreg key for access permissions to those paths.

Default: None.


Network access: Shares that can be accessed anonymously

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines which network shares can accessed by anonymous users.

Default: None.


Network access: Sharing and security model for local accounts

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines how network logons that use local accounts are authenticated. If this setting is set to Classic, network logons that use local account credentials authenticate by using those credentials. If this setting is set to Guest only, network logons that use local accounts are automatically mapped to the Guest account. The Classic model allows fine control over access to resources. By using the Classic model, you can grant different types of access to different users for the same resource. Using the Guest only model, all users are treated equally. All users authenticate as Guest, and they all receive the same level of access to a given resource, which can be either Read Only or Modify.

There are two models available:

  • Classic: local users authenticate as themselves.
  • Guest only: local users authenticate as Guest.

Default: Guest only on Windows XP Professional.

Notes

  • This setting does not affect network logons that use domain accounts.
  • This setting does not affect interactive logons that are performed remotely by using services such as Telnet or Terminal Services.
  • When the computer is not joined to a domain, this setting also tailors the Sharing and Security tabs in Windows Explorer to correspond to the sharing and security model that is being used.

Caution

  • With the Guest only model, any user who can access your computer over the network (including anonymous Internet users) can access your shared resources. You must protect your computer from unauthorized access by using Windows Firewall or other similar device. Similarly, with the Classic model, local accounts must be be password protected; otherwise, those user accounts can be used by anyone to access shared system resources.

This policy does not apply on Windows 2000 computers.


Network security: Do not store LAN Manager hash value on next password change

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines if, at the next password change, LAN Manager is prevented from storing hash values for the new password.

Default: Disabled.


Network security: Force logoff when logon hours expire

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether to disconnect users who are connected to the local computer outside their user account's valid logon hours. This setting affects the Server Message Block (SMB) component.

When this policy is enabled, it causes client sessions with the SMB server to be forcibly disconnected when the client's logon hours expire.

If this policy is disabled, an established client session is allowed to be maintained after the client's logon hours have expired.

Default: Enabled.

Note

  • For domain accounts, there can be only one account policy. The account policy must be defined in the Default Domain Policy, and it is enforced by the domain controllers that make up the domain. A domain controller always pulls the account policy from the Default Domain Policy Group Policy object (GPO), even if there is a different account policy applied to the organizational unit that contains the domain controller. By default, workstations and servers that are joined to a domain (i.e., member computers) also receive the same account policy for their local accounts. However, local account policies for member computers can be different from the domain account policy by defining an account policy for the organizational unit that contains the member computers. Kerberos settings are not applied to member computers.

For more information, see:

  • Set logon hours


Network security: LAN Manager authentication level

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows:

  • Send LM & NTLM responses: Clients use LM and NTLM authentication and never use NTLMv2 session security; domain controllers accept LM, NTLM, and NTLMv2 authentication.
  • Send LM & NTLM - use NTLMv2 session security if negotiated: Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication.
  • Send NTLM response only: Clients use NTLM authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication.
  • Send NTLMv2 response only: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication.
  • Send NTLMv2 response only\refuse LM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM (accept only NTLM and NTLMv2 authentication).
  • Send NTLMv2 response only\refuse LM & NTLM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM and NTLM (accept only NTLMv2 authentication).

Default:

  • Send LM & NTLM responses on server.
  • Undefined on workstations.

Important

  • This setting can affect the ability of Windows 2000 Server, Windows 2000 Professional, and Windows XP Professional computers to communicate with Windows NT 4.0 and earlier clients over the network. For example, at the time of this writing, Windows NT 4.0 computers earlier than SP4 do not support NTLMv2. Windows 95 and Windows 98 computers do not support NTLM.
  • Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Network security: Lan Manager authentication level (http://go.microsoft.com/fwlink/?LinkId=24278) at the Microsoft website.


Network security: Minimum session security for NTLM SSP based (including secure RPC) clients

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines the minimum security standards for an application-to-application communications session for a client.

Historically, Windows NT supports two variants of challenge/response authentication for network logons:

  • LAN Manager (LM) challenge/response
  • NTLM version 1 challenge/response)

LM allows interoperability with the installed base of clients and servers. NTLM provides improved security for connections between clients and servers.

Default: No requirements.

Important

  • This setting applies to any Windows 2000 computers, but it is not viewable from those computers.


Network security: Minimum session security for NTLM SSP based (including secure RPC) servers

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines the minimum security standards for an application-to-application communications session on a server.

Historically, Windows NT supports two variants of challenge/response authentication for network logons:

  • LAN Manager (LM) challenge/response
  • NTLM version 1 challenge/response)

LM allows interoperability with the installed base of clients and servers. NTLM provides improved security for connections between clients and servers.

Default: No requirements.

Important

  • This setting applies to any Windows 2000 computers, but it is not viewable from those computers.


Recovery console: Allow automatic administrative logon

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines if the password for the Administrator account must be given before access to the system is granted. If this option is enabled, the Recovery Console does not require you to provide a password, and it automatically logs on to the system.

Default: Disabled.


Recovery console: Allow floppy copy and access to all drives and all folders

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Enabling this option makes the Recovery Console SET command available, which allows you to set the following Recovery Console environment variables:

  • AllowWildCards: Enable wildcard support for some commands (such as the DEL command).
  • AllowAllPaths: Allow access to all files and folders on the computer.
  • AllowRemovableMedia: Allow files to be copied to removable media, such as a floppy disk.
  • NoCopyPrompt: Do not prompt when overwriting an existing file.

Default: Disabled.


Shutdown: Allow system to be shut down without having to log on

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether a computer can be shut down without having to log on to Windows.

When this policy is enabled, the Shut Down command is available on the Windows logon screen.

When this policy is disabled, the option to shut down the computer does not appear on the Windows logon screen. In this case, users must be able to log on to the computer successfully and have the Shut down the system user right before they can perform a system shutdown.

Default

  • Enabled on workstations.
  • Disabled on servers.


Shutdown: Clear virtual memory pagefile

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the virtual memory pagefile is cleared when the system is shut down.

Virtual memory support uses a system pagefile to swap pages of memory to disk when they are not used. On a running system, this pagefile is opened exclusively by the operating system, and it is well protected. However, systems that are configured to allow booting to other operating systems might have to make sure that the system pagefile is wiped clean when this system shuts down. This ensures that sensitive information from process memory that might go into the pagefile is not available to an unauthorized user who manages to directly access the pagefile.

When this policy is enabled, it causes the system pagefile to be cleared upon clean shutdown. If you enable this security option, the hibernation file (hiberfil.sys) is also zeroed out when hibernation is disabled on a portable computer system.

Default: Disabled.


System cryptography: Use FIPS compliant algorithms for encryption

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines if the TLS/SSL Security Provider supports only the TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher suite. In effect, this means that the provider only supports the TLS protocol as a client and as a server (if applicable). It uses only the Triple DES encryption algorithm for the TLS traffic encryption, only the RSA public key algorithm for the TLS key exchange and authentication, and only the SHA-1 hashing algorithm for the TLS hashing requirements.

For Encrypting File System Service (EFS), it supports only the Triple DES encryption algorithm for encrypting file data supported by the Windows NTFS File System. By default, the Encrypting File System Service (EFS) uses the DESX algorithm for encrypting file data.

Default: Disabled.


System objects: Default owner for objects created by members of the administrators group

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the Administrators group or an object creator is the default owner of any system objects that are created.

Default: Administrators group (on servers).


System objects: Require case insensitivity for non-Windows subsystems

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether case insensitivity is enforced for all subsystems. The Win32 subsystem is case insensitive. However, the kernel supports case sensitivity for other subsystems, such as POSIX.

If this setting is enabled, case insensitivity is enforced for all directory objects, symbolic links, and IO objects, including file objects. Disabling this setting does not allow the Win32 subsystem to become case sensitive.

Default: Enabled.


System objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines the strength of the default discretionary access control list (DACL) for objects.

Active Directory maintains a global list of shared system resources, such as DOS device names, mutexes, and semaphores. In this way, objects can be located and shared among processes. Each type of object is created with a default DACL that specifies who can access the objects and what permissions are granted.

If this policy is enabled, the default DACL is stronger, allowing users who are not administrators to read shared objects but not allowing these users to modify shared objects that they did not create.

Default: Enabled.


Event Log

This section covers:

  • Settings for Event Log


Settings for Event Log

This section covers:

  • Maximum application log size
  • Maximum security log size
  • Maximum system log size
  • Prevent local guests group from accessing application log
  • Prevent local guests group from accessing security log
  • Prevent local guests group from accessing system log
  • Retain application log
  • Retain security log
  • Retain system log
  • Retention method for application log
  • Retention method for security log
  • Retention method for system log


Maximum application log size

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Specifies the maximum size of the application event log, which has a maximum of 4 GB.

Default: 512 KB.

Note

  • This setting does not appear in the Local Computer Policy object.


Maximum security log size

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Specifies the maximum size of the security event log, which has a minimum size of 4 GB.

Default: 512 KB.

Important

  • Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Event Log: Maximum security log size (http://go.microsoft.com/fwlink/?LinkId=24280) at the Microsoft website.

Note

  • This setting does not appear in the Local Computer Policy object.


Maximum system log size

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Specifies the maximum size of the system event log, which has a maximum size of 4 GB.

Default: 512 KB.

Note

  • This setting does not appear in the Local Computer Policy object.


Prevent local guests group from accessing application log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines if guests are prevented from accessing the application event log.

Default: Disabled.

Note

  • This setting does not appear in the Local Computer Policy object.


Prevent local guests group from accessing security log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines if guests are prevented from accessing the security event log.

Default: Disabled.

Notes

  • This setting does not appear in the Local Computer Policy object.
  • A user must possess the Manage auditing and security log user right to access the security log.


Prevent local guests group from accessing system log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines if guests are prevented from accessing the system event log.

Default: Disabled.

Note

  • This setting does not appear in the Local Computer Policy object.


Retain application log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines the number of days' worth of events to be retained for the application log if the retention method for the application log is "By Days."

Set this value only if you archive the log at scheduled intervals and you make sure that the Maximum application log size is large enough to accommodate the interval.

Default: None.

Notes

  • This setting does not appear in the Local Computer Policy object.
  • A user must possess the Manage auditing and security log user right to access the security log.


Retain security log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines the number of days' worth of events to be retained for the security log if the retention method for the security log is "By Days."

Set this value only if you archive the log at scheduled intervals and you make sure that the Maximum security log size is large enough to accommodate the interval.

Default: None.

Note

  • This setting does not appear in the Local Computer Policy object.


Retain system log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines the number of days' worth of events to be retained for the system log if the retention method for the system log is "By Days."

Set this value only if you archive the log at scheduled intervals and you make sure that the Maximum system log size is large enough to accommodate the interval.

Default: None.

Note

  • This setting does not appear in the Local Computer Policy object.


Retention method for application log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines the "wrapping" method for the application log.

If you do not archive the application log, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Overwrite events as needed.

If you archive the log at scheduled intervals, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Overwrite events by days and specify the appropriate number of days in the "Retain application log" setting. Make sure that the Maximum application log size is large enough to accommodate the interval.

If you must retain all the events in the log, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Do not overwrite events (clear log manually). This option requires that the log be cleared manually. In this case, when the maximum log size is reached, new events are discarded.

Default: None.

Note

  • This setting does not appear in the Local Computer Policy object.


Retention method for security log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines the "wrapping" method for the security log.

If you do not archive the security log, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Overwrite events as needed.

If you archive the log at scheduled intervals, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Overwrite events by days and specify the appropriate number of days in the retain security log setting. Make sure that the Maximum security log size is large enough to accommodate the interval.

If you must retain all the events in the log, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Do not overwrite events (clear log manually). This option requires that the log be cleared manually. In this case, when the maximum log size is reached, new events are discarded.

Default: None.

Note

  • This setting does not appear in the Local Computer Policy object.


Retention method for system log

Computer Configuration\Windows Settings\system Settings\Event Log\Settings for Event Logs

Description

Determines the "wrapping" method for the system log.

If you do not archive the system log, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Overwrite events as needed.

If you archive the log at scheduled intervals, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Overwrite events by days and specify the appropriate number of days in the "Retain system log" setting. Make sure that the Maximum system log size is large enough to accommodate the interval.

If you must retain all the events in the log, in the Properties dialog box for this policy, select the Define this policy setting check box, and then click Do not overwrite events (clear log manually). This option requires that the log be cleared manually. In this case, when the maximum log size is reached, new events are discarded.

Default: None.

Note

  • This setting does not appear in the Local Computer Policy object.


Restricted Groups

Computer Configuration\Windows Settings\Security Settings\Restricted Groups

Description

Allows an administrator to define two properties for security-sensitive groups ("restricted" groups).

The two properties are "Members" and "Member Of." The Members list defines who belongs and who does not belong to the restricted group. The Member Of list specifies which other groups the restricted group belongs to.

When a restricted Group Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added.

The Restricted Groups folder is available only in Group Policy objects associated with domains, organizational units, and sites. The Restricted Groups folder does not appear in the Local Computer Policy object.

If a restricted group is defined so that it has no members (i.e., the Members list is empty), all members of the group are removed when the policy is enforced on the system. If the Member Of list is empty, no changes are made to any groups to which the restricted group belongs.

Default: None specified.

Note

  • An empty Members list means that the restricted group has no members; an empty Member Of list means that the groups to which the restricted group belongs are not specified.


System Services

Computer Configuration\Windows Settings\Security Settings\System Services

Description

Allows an administrator to define the startup mode (manual, automatic, or disabled) as well as the access permissions (Start, Stop, or Pause) for all system services.

Default: Undefined.

Note

  • This setting does not appear in the Local Computer Policy object.


Registry

Computer Configuration\Windows Settings\Security Settings\Registry

Description

Allows an administrator to define access permissions (on DACLs) and audit settings (on SACLs) for registry keys.

Default: Undefined.

Note

  • This setting does not appear in the Local Computer Policy object.


File System

Computer Configuration\Windows Settings\Security Settings\File System

Description

Allows an administrator to define access permissions (on DACLs) and audit settings (on SACLs) for file system objects.

Default: Undefined.

Note

  • This setting does not appear in the Local Computer Policy object.


Public Key Policies

By using Public Key Policies in a Windows 2000 domain, an administrator can automatically issue certificates to computers, manage encrypted data recovery agents, create certificate trust lists, or automatically establish trust of certification authorities.

  • For help with specific tasks, see How to.
  • For general background information, see Concepts.


How to...

  • Add a trusted root certification authority to a Group Policy object
  • Delete a trusted root certification authority from a Group Policy object
  • Create an automatic certificate request for computers in a Group Policy object
  • Delete an automatic certificate request for computers in a Group Policy object
  • Create a certificate trust list for a Group Policy object
  • Edit a certificate trust list for a Group Policy object
  • Delete a certificate trust list for a Group Policy object
  • Add a recovery agent for the local computer
  • Add a recovery agent for a domain
  • Change the recovery policy for the local computer
  • Change the recovery policy for a domain


Add a trusted root certification authority to a Group Policy object

Microsoft Windows graphic

To add a trusted root certification authority to a Group Policy object

  1. Log on to a domain for which you have administrative privileges to manage the Group Policy object that you want to change.
  2. Open the Group Policy object that you want to edit.
  3. In the console tree, click Trusted Root Certification Authorities.

    Where?

    • Policy Object Name
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Public Key Policies
    • Trusted Root Certification Authorities
  4. On the Action menu, point to All Tasks, and then click Import. This starts the Certificate Import Wizard, which guides you through the process of importing a root certificate and installing it as a trusted root certification authority (CA) for this Group Policy object.

Note

  • To open a Group Policy object, see Related Topics.
  • To use this procedure, you must have administrative privileges for the Group Policy object.
  • This procedure does not apply to Local Policy objects.
  • You can import a trusted root certificate from a PKCS #12 file (.pfx, .p12), a PKCS #7 file (.spc, .p7b), a certificate file (.cer, .crt), or a Microsoft serialized certificate store file (.sst).

Related Topics


Delete a trusted root certification authority from a Group Policy object

Microsoft Windows graphic

To delete a trusted root certification authority from a Group Policy object

  1. Log on to a domain for which you have administrative privileges to manage the Group Policy object that you want to change.
  2. Open the Group Policy object that you want to edit.
  3. In the console tree, click Trusted Root Certification Authorities.

    Where?

    • Policy Object Name
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Public Key Policies
    • Trusted Root Certification Authorities
  4. In the details pane, click the root certificate that you want to delete.
  5. On the Action menu, click Delete.
  6. Click Yes if you are sure that you want to delete this certificate.

Notes

  • To open a Group Policy object, see Related Topics.
  • To use this procedure, you must have administrative privileges for the Group Policy object.
  • This procedure does not apply to Local Policy objects.

Related Topics


Create an automatic certificate request for computers in a Group Policy object

Microsoft Windows graphic

To create an automatic certificate request for computers in a Group Policy object

  1. Log on to a domain with administrative privileges to manage the Group Policy object that you want to change.
  2. Open the Group Policy object that you want to edit.
  3. In the console tree, click Automatic Certificate Request Settings.

    Where?

    • Policy Object Name
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Public Key Policies
    • Automatic Certificate Request Settings
  4. On the Action menu, point to New, and then click Automatic Certificate Request. This starts the Automatic Certificate Request Setup Wizard. Follow the steps in the wizard to create an automatic certificate request for computers that have this Group Policy object applied to them.

Notes

  • To open a Group Policy object, see Related Topics.
  • To use this procedure, you must have administrative privileges for the Group Policy object.
  • This procedure does not apply to Local Policy objects.
  • To use the Automatic Certificate Request Setup Wizard, you need the following information:
    • The certificate template that you want to use. A certificate that is based on the selected template will be requested automatically at the first occurrence of any of the following: a user logs on, Group Policy is refreshed, or a computer joins the domain and is subject to a Group Policy setting.
    • The name of the certification authority (CA) in your domain that will issue the requested certificates. The CA must be an enterprise CA that is configured by its administrator to issue the certificate type that is being requested.
  • There can only be one certificate request for each certificate type per Group Policy object.

Related Topics


Delete an automatic certificate request for computers in a Group Policy object

Microsoft Windows graphic

To delete an automatic certificate request for computers in a Group Policy object

  1. Log on to a domain for which you have administrative privileges to manage the Group Policy object that you want to change.
  2. Open the Group Policy object that you want to edit.
  3. In the console tree, click Automatic Certificate Request Settings.

    Where?

    • Policy Object Name
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Public Key Policies
    • Automatic Certificate Request Settings
  4. In the details pane, click the automatic certificate request that you want to delete.
  5. On the Action menu, click Delete.
  6. Click Yes if you are sure that you want to delete this automatic certificate request.

Notes

  • To open a Group Policy object, see Related Topics.
  • To use this procedure, you must have administrative privileges for the Group Policy object.
  • This procedure does not apply to Local Policy objects.

Related Topics


Create a certificate trust list for a Group Policy object

Microsoft Windows graphic

To create a certificate trust list for a Group Policy object

  1. Log on to a domain for which you have administrative privileges to manage the Group Policy object that you want to change.
  2. Open the Group Policy object that you want to edit.
  3. In the console tree, click Enterprise Trust.

    Where?

    • Policy Object Name
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Public Key Policies
    • Enterprise Trust
  4. On the Action menu, point to New, and then click Certificate Trust List. This starts the Certificate Trust List Wizard. Follow the steps in the wizard to create a certificate trust list for the Group Policy object.

Notes

  • To open a Group Policy object, see Related Topics.
  • To use this procedure, you must have administrative privileges for the Group Policy object.
  • This procedure does not apply to Local Policy objects.

  • To use the Certificate Trust List Wizard, you need the following information:

    • The certificate purposes for this certificate trust list (CTL). For more information about certificate trust list purposes, see Using enterprise trust policy.
    • The certificates that you want to add to the certificate trust list. You can add certificates from the certificate store on the local computer or from a file. Acceptable file formats from which you can import a certificate are an X.509v3 certificate file (.cer, .crt), a PKCS #7 file (.spc, .p7b), or a Microsoft serialized certificate store (.sst).
    • A certificate that has the Trust List Signing purpose and its associated private key in your personal certificate store. For general instructions on how to request a certificate, see Request a certificate.
    • As an option, you can enter a time stamp service URL to time stamp the certificate trust list.

Related Topics


Edit a certificate trust list for a Group Policy object

Microsoft Windows graphic

To edit a certificate trust list for a Group Policy object

  1. Log on to a domain for which you have administrative privileges to manage the Group Policy object that you want to change.
  2. Open the Group Policy object that you want to edit.
  3. In the console tree, click Enterprise Trust.

    Where?

    • Policy Object Name
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Public Key Policies
    • Enterprise Trust
  4. In the details pane, click the certificate trust list (CTL) that you want to edit.
  5. On the Action menu, point to All Tasks, and then click Edit. This starts the Certificate Trust List Wizard. Follow the steps in the wizard to edit the certificate trust list for the Group Policy object.

Notes

  • To open a Group Policy object, see Related Topics.
  • To use this procedure, you must have administrative privileges for the Group Policy object.
  • This procedure does not apply to Local Policy objects.

  • To use the Certificate Trust List Wizard, you need the following information:

    • The certificate purposes for this certificate trust list. For more information about certificate trust list purposes, see Using enterprise trust policy.
    • The certificates that you want to add to the certificate trust list. You can add certificates from the certificate store on the local computer or from a file. Acceptable file formats from which you can import a certificate are an X.509v3 certificate file (.cer, .crt), a PKCS #7 file (.spc, .p7b) or a Microsoft serialized certificate store (.sst).
    • A certificate that has the Trust List Signing purpose and its associated private key in your personal certificate store. For general instructions on how to request a certificate, see Request a certificate.
    • As an option, you can enter a time stamp service URL to time stamp the certificate trust list.

Related Topics


Delete a certificate trust list for a Group Policy object

Microsoft Windows graphic

To delete a certificate trust list for a Group Policy object

  1. Log on to a domain for which you have administrative privileges to manage the Group Policy object that you want to change.
  2. Open the Group Policy object that you want to edit.
  3. In the console tree, click Enterprise Trust.

    Where?

    • Policy Object Name
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Public Key Policies
    • Enterprise Trust
  4. In the details pane, click the certificate trust list (CTL) that you want to delete.
  5. On the Action menu, click Delete.
  6. Click Yes if you are sure that you want to delete this certificate trust list.

Notes

  • To open a Group Policy object, see Related Topics.
  • To use this procedure, you must have administrative privileges for the Group Policy object.
  • This procedure does not apply to Local Policy objects.

Related Topics


Concepts

This section covers:

  • Public Key Policies overview
  • Understanding Public Key Policies
  • Using Public Key Policies


Public Key Policies overview

You can use the public key policy settings in Group Policy to:

  • Have computers automatically submit a certificate request to an enterprise certification authority and install the issued certificate. This is useful for ensuring that computers have the certificates that they need to perform public key cryptographic operations in your organization, for example, for Internet Protocol security (IPSec) or for client authentication. For more information about certificate autoenrollment for computers, see Automatic certificate request settings.

  • Create and distribute a certificate trust list (CTL). A certificate trust list is a signed list of root certification authority (CA) certificates that an administrator considers reputable for designated purposes such as client authentication or secure e-mail. For example, if you want to trust a certification authority's certificates for IPSec, but not for client authentication, you can implement that trust relationship with a certificate trust list. For more information about certificate trust lists, see Enterprise trust policy.

  • Establish common trusted root certification authorities. You can use this policy setting to make computers and users subject to common root certification authorities (in addition to the ones that they already trust individually). It is not necessary to use this policy setting for certification authorities in a domain, because they are already trusted by all users and computers in the domain. This policy is primarily for establishing trust in a root certification authority that is not a part of your organization. For more information about root certification authorities, see Policies to establish trust of root certification authorities.

  • Add encrypted data recovery agents, and change the encrypted data recovery policy settings. For more information about this policy setting, see Recovering data. For a general overview of the Encrypting File System (EFS), see Encrypting File System overview.
It is not necessary for you to use these public key policy settings in Group Policy to deploy a public key infrastructure in your organization. However, these settings give you additional flexibility and control when you establish trust in certification authorities, issue certificates to computers, and deploy EFS across a domain.


Understanding Public Key Policies

You can create public key policies for distribution to computers or users within a site, domain, or organizational unit. To do this, use Group Policy, with the Security Settings extension enabled. This section covers:

  • Automatic certificate request settings
  • Policies to establish trust of root certification authorities
  • Enterprise trust policy
  • Recovering data


Automatic certificate request settings

Certificate enrollment is the process of requesting, receiving, and installing a certificate. By using automatic certificate settings in Public Key Policies, you can have computers that are associated with a Group Policy object automatically enroll for certificates. This can save you the step of explicitly enrolling for computer-related certificates for each computer.

After you establish an automatic certificate request, the actual certificate requests occur the next time that the computers that are associated with the Group Policy object log on to the network.

For more information, see:

  • Automatic certificate request policy
  • Public Key Policies overview

Notes

  • Automatic certificate requests work only with certification authorities (CA) that run the enterprise policy module.
  • You must have administrative privileges to establish automatic certificate requests for a Group Policy object.


Policies to establish trust of root certification authorities

When a client presents a certificate to a host, the host has to trust the certificate of the root certification authority (CA) in the certification path to accept the certificate as a valid credential. You might want to establish trust automatically in specific root CAs for groups of users or computers.

You can use Public Key Policies in Group Policy to establish common trusted root CAs for the users and computers that are associated with a Group Policy object. When you apply the Group Policy object to a site, domain, or organizational unit, the policy is inherited by the corresponding computers. These computers then trust the root CAs whose certificates you have imported into the trusted root certification authority policy.

You have the option of designating trusted CAs by using either the trusted root certification authority policy or the enterprise trust policy. Use the following guidelines in determining which policy to use:

  • If your organization has its own Windows 2000 root CAs and uses Active Directory, you do not need to use the Group Policy mechanism to distribute the root certificates.
  • If your organization has its own root CAs that are installed on servers that are not running Windows 2000, use the trusted root certification authority policy to distribute your organization's root certificates. For more information, see Trusted root certification authority policy.
  • If your organization does not have its own CAs, use the enterprise trust policy to create certificate trust lists (CTL) to establish your organization's trust of external root CAs.

For more information, see:

  • Enterprise trust policy
  • Public Key Policies overview


Enterprise trust policy

A certificate trust list (CTL) enables you to control trust of the purpose and of the validity period of certificates that are issued by external certification authorities (CA).

Typically, a certification authority can issue certificates for a wide variety of purposes, such as secure e-mail or client authentication. But there might be situations in which you want to limit the trust of certificates that are issued by a particular certification authority, especially if the CA is outside your organization. In these situations, creating a certificate trust list and using it through Group Policy can be useful.

Suppose, for example, a certification authority named "My CA" is capable of issuing certificates for server authentication, client authentication, code signing, and secure e-mail. However, you only want to trust certificates issued by My CA for the purpose of client authentication. You can create a certificate trust list and limit the purpose for which you trust certificates issued by My CA so that they are only valid for client authentication. Any certificates issued for another purpose by My CA are not accepted for use by any computer or user in the scope of the Group Policy object to which the certificate trust list is applied.

There can be multiple certificate trust lists in an organization. Because the uses and trusts of certificates for particular domains or organizational units might be different, you can create separate certificate trust lists to reflect these uses and assign particular certificate trust lists to particular Group Policy objects.

Through the use of Group Policy in your organization, you have the option of designating trust in CAs by using either the trusted root certification authority policy or the enterprise trust policy (certificate trust lists). Use the following guidelines in determining which policy to use:

  • If your organization has its own root CAs and uses Active Directory, you do not need to use the Group Policy mechanism to distribute those root certificates.
  • If your organization has its own root CAs that are not installed on servers, you should use the trusted root certification authority policy to distribute your organization's root certificates.
  • If your organization does not have its own CAs, use the enterprise trust policy to create certificate trust lists to establish your organization's trust of external root CAs.

For more information, see:

  • Trusted root certification authority policy
  • Using enterprise trust policy
  • Public Key Policies overview


Using Public Key Policies

This section covers:

  • Automatic certificate request policy
  • Trusted root certification authority policy
  • Using enterprise trust policy
  • Encrypted data recovery agents policy


Automatic certificate request policy

To create an automatic certificate request, you need the following information:

  • The certificate type that you want computers that are associated with the Group Policy object to enroll for automatically. Computers can automatically request only certificate types that have a purpose that is associated with computers, not with users. Examples of computer-related certificates include:
    • Computer certificates
    • Internet Protocol security (IPSec) certificates
    • Web server certificates
  • The certification authority (CA) that can issue the certificate.

    You can select from among a predefined list of CAs. The CA that you select must be capable of issuing a certificate of the type and purpose that you have specified.

For more information, see:

  • Automatic certificate request settings
  • Create an automatic certificate request for computers in a Group Policy object
  • Delete an automatic certificate request for computers in a Group Policy object


Trusted root certification authority policy

To establish a trusted root certification authority (CA) using Group Policy, the Group Policy object that you create must have access to the root certificate. This requires that you import a copy of the root authority certificate.

You can do this by using the procedure Add a trusted root certification authority to a Group Policy object.

For a root CA certificate to be imported, the root certificate must be in a PKCS #12 file, PKCS #7 file, or binary-encoded X.509v3 certificate files. For more information about these file formats, see Importing and exporting certificates.

For more information, see:
  • Policies to establish trust of root certification authorities
  • Delete a trusted root certification authority from a Group Policy object


Using enterprise trust policy

You can assign a certificate trust list (CTL) to a Group Policy object either by creating a new certificate trust list or by importing an existing one. If you are creating a new certificate trust list, you must sign the certificate trust list with a certificate issued for this purpose by a certification authority (CA).

Creating a certificate trust list also requires:

  • The root certificates that you want to include in the certificate trust list.
  • That you know the purposes for which you want to trust the root certificates in the certificate trust list.

For more information, see:

  • Enterprise trust policy
  • Create a certificate trust list for a Group Policy object
  • Edit a certificate trust list for a Group Policy object
  • Delete a certificate trust list for a Group Policy object


Encrypted data recovery agents policy

You can manage encrypted data recovery policy for computers in a domain by using the following procedures:

  • Add a recovery agent for a domain
  • Change the recovery policy for a domain

You can manage encrypted data recovery policy for a local computer by using the following procedures:

  • Add a recovery agent for the local computer
  • Change the recovery policy for the local computer

For more information, see:

  • Encrypting File System overview
  • Recovering data


Remove computer from docking station

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can remove a portable computer from its docking station.

Default: On servers and workstations, Administrators, Power Users, and Users have the right to remove a portable computer from its docking station on computers that contain "clean installations" of Windows 2000 Server, Windows 2000 Professional, and Windows XP Professional, that is, installations that have not been upgraded from a previous version of Windows.

Note

  • On computers that have been upgraded from Windows NT to Windows 2000 Server, Windows 2000 Professional, or Windows XP Professional, this right to remove the portable computer from its docking station must be explicitly granted to the appropriate group or user.


Shut down the computer when the security audit log is full

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determine if the system will be automatically shut down if the security audit file has reached maximum size.

Default: None.

Notes

  • It is suggested that Audit: Shut down system immediately if unable to log security audits is used, instead of this policy setting.
  • This setting does not appear in the Local Computer Policy object.