Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Apply Security Templates

Security templates have no effect upon the operating system unless they are applied. This can be done by using Group Policy, by using Security Configuration and Analysis, or by using the secedit command.

WARNING: On the Other Hand…

If a security template is incorrectly configured and then applied, it can make a computer inoperable. If it is imported into a Group Policy Object, it can make many machines inoperable.

Use an Active Directory Design to Secure Computer Roles

An appropriate Active Directory design to fulfill your needs is beyond the scope of this book. However, the following Active Directory design supports the security architecture defined by server roles. It allows the majority of security settings appropriate for securing various servers to be applied periodically and efficiently across multiple servers. It utilizes the templates provided with the "Windows Server 2003 Security Guide" and allows for its extension via the creation of additional templates.

Active Directory planning information, including design tips and best practices, is presented in the Windows Server 2003 Development Kit. This set can be purchased or searched online. Specifically, Active Directory design is addressed in the "Designing and Deploying Active Directory and Security Services" book at http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=6cde6ee7-5df1-4394-92ed-2147c3a9ebbe.

In this design, two top-level OUs are created; one for servers and one for workstations. Underneath these OUs, sub-OUs are created, one for each computer role. This allows the development of unique security designs for each role and their implementation, as much as possible, through GPOs linked to the appropriate OU. Figure 11-9 displays the design. In the figure, two top-level OUs are labeled WorkstationOU and ServerOU. The workstationOU has a sub-OU for Windows 2000 Professional and one for Windows XP.

The computer accounts for each type of workstation and server can then be added to the appropriate OUs. Each OU as well as the domain must have an appropriate GPO created and linked to its container. A security template can be designed for and then imported into the appropriate OU. Templates created by Microsoft or third parties can be used, or custom templates can be created. Be sure an appropriate template is available for each OU.

Table 11-7 is a hypothetical design that lists each OU, template type, and a number of unique templates that might be created if these specific roles exist. Each template is given a name, but those that begin with an asterisk (*) are not provided by Microsoft. You can create templates with any name you choose.

To apply this design, the templates must be created, and then they must be imported into the Group Policy Object that is linked to the appropriate OU. Before taking this action, be sure to back up the GPO. To import the settings, perform these steps:

Alternatively, if GPMC has been installed, right-click the GPO in the GPO section of the GPMC and then select Import Settings, as shown in Figure 11-10. In either case, the Import Settings Wizard will run and allow you to select and apply the desired security template. When GPMC is used, you are prompted to back up the GPO before importing the settings.

Using the Security Configuration and Analysis Tool

Security Configuration and Analysis is a MMC snap-in tool that can be used to apply security templates to a single computer or to compare a specific security template to the computer's current settings. A command-line version of the tool, secedit, is also available. This tool fits both in the standalone and Active Directory approach to security configuration.

In an Active Directory Environment, the tool can be used in a test lab to configure systems and test new templates. Instead of applying a new template to many machines at once, with potentially harmful results, the template can be tested on a single machine. It can also be used in the production environment to test the security status of specific computers.

Where no Active Directory environment exists, or where some computers are not joined to the domain, Security Configuration and Analysis can be used to apply standard security settings to a single computer in an automated fashion. The secedit command-line tool can be used in a script to apply settings on a single computer or potentially many computers. Both tools can be used to audit current security settings against an approved template.

The best way to apply security templates to domain member computers is to use Group Policy and Active Directory. If you correctly configure the GPOs, settings will be applied, and security settings will be refreshed at regular intervals. However, Windows 2000, Windows XP Professional, or Windows Server 2003 computers that are not members of a domain can still benefit from the use of security templates and the baselining process. The Security Configuration and Analysis console or its command-line version, secedit, can be used to apply the templates. The following procedures tell you how.

Using Multiple Templates with Security Configuration and Analysis

A great way to apply security using Group Policy is to incorporate a design using multiple policies, each of which may utilize a different template. The use of a baseline hardening template and an incremental role-specific template is one such design. The same sort of security design can be planned for standalone computers; however, you must pay attention to the order of template application. Applying multiple templates using Security Configuration and Analysis may seem simple, but it can become complicated. Three factors play a role: the current security status of the machine, the order of template application, and whether or not the database is cleared before a new template is applied. When the tool is first run, it creates a database whose settings are based on your selection of a preconfigured security template. Alternatively, you can select and use a previously created database. If an old database is cleared when the new template is added, only the settings in the new template are applied. However, if the old template settings were previously applied to the machine, clearing the template from the database does not remove these settings. If the database is not cleared, adding an additional template means the following:

If the new template setting is not defined and the old template setting is defined, the setting remains the way it is in the old template.

If a setting in the new template is defined and the setting is not defined in the old template, the setting changes to the setting in the new template.

If a setting is defined in both the old template and the new template, the new template setting is applied.

Apply the Template

The process for applying a template is simple. In the following example, a custom adaptation of the Enterprise Client Member Server Baselinetemplate is applied. The template is named baselineB.inf. A good practice is to create a rollback template, which can be used in case the template causes a problem. In the following example, the command line used to create the rollback template baselineBrollback.inf is given and the syntax is explained in Table 11-8. You do not have to create a rollback template; however, doing so provides you with a quick way to reverse the settings made by applying the template.

Use secedit to Apply Security Templates

secedit is a command-line version of the Security Configuration and Analysis snap-in. It also provides the ability to create rollback templates, which, when applied, reverse settings established by another template. Basic secedit commands are defined in Table 11-8.

To configure the machine using the XYZ template, use the following command:

secedit /configure /db xyz.sdb /cfg xyz.inf /log xyz.log

To create a rollback template for the XYZ template, use the following command:

secedit /generaterollback /cfg xyz.inf /rbk xyzrollback.inf /log xyzrollback.log