Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

اینجــــا یک کتابخانه دیجیتالی است

با بیش از 100000 منبع الکترونیکی رایگان به زبان فارسی ، عربی و انگلیسی

Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] - نسخه متنی

Roberta Bragg

| نمايش فراداده ، افزودن یک نقد و بررسی
افزودن به کتابخانه شخصی
ارسال به دوستان
جستجو در متن کتاب
بیشتر
تنظیمات قلم

فونت

اندازه قلم

+ - پیش فرض

حالت نمایش

روز نیمروز شب
جستجو در لغت نامه
بیشتر
لیست موضوعات
توضیحات
افزودن یادداشت جدید







Additional Security Configuration


In addition to the security configuration that can be done in GPOs and security templates, other items should be addressed:

Group membership
Membership in groups that have administrative privileges should be carefully considered and monitored. Examples of groups to pay particular attention to are Enterprise Admins and Schema Admins. Enterprise Admins can administer every domain in the forest and have additional forest-wide administration privileges not given to Domain Admins. Membership in Enterprise Admins should be restricted. Schema Admins can modify the Active Directory schema, a privilege that should not be given out lightly; in fact, best practices recommend that this group be empty until the need to modify the schema and the approval to do so is obtained.

Active Directory object permissions
Active Directory objects are also permissioned. Permissions on these objects also provide the holder with possible privileges, such as resetting account passwords for other users, full control including the development of GPOs, and so on. Active Directory object permissions should not be changed without a firm understanding of what the change does.

Secure configuration of server services implemented on DCs, such as DNS, Certification Authority, DHCP, WINS, and so on.

Direct registry modification
The registry can be directly modified.

Direct change of file and registry permissions
Permissions can be changed directly on files, folders, and registry keys.



/ 194