Scribd
Upload
170 views6 pages

Windows 2008 R2 Hardening Checklist

This document provides a checklist for hardening a Windows 2008 R2 server based on guidelines from the Center for Internet Security (CIS). The checklist includes over 40 specific configuration steps across categories like service packs and hotfixes, security settings, additional protection, and antivirus/antispyware. Notes are provided to clarify steps for the computing environment at The University of Texas at Austin. The checklist is to be used by administrators to securely configure new servers and is also used by the Information Security Office to verify server security during risk assessments.

Uploaded by

Cesarina Sosa
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
170 views6 pages

Windows 2008 R2 Hardening Checklist

This document provides a checklist for hardening a Windows 2008 R2 server based on guidelines from the Center for Internet Security (CIS). The checklist includes over 40 specific configuration steps across categories like service packs and hotfixes, security settings, additional protection, and antivirus/antispyware. Notes are provided to clarify steps for the computing environment at The University of Texas at Austin. The checklist is to be used by administrators to securely configure new servers and is also used by the Information Security Office to verify server security during risk assessments.

Uploaded by

Cesarina Sosa
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Windows 2008 R2 Server Hardening Checklist - Cis

The hardening checklists are based on the comprehensive checklists produced by CIS. The Information Security Office has
distilled the CIS lists down to the most critical steps for your systems, with a particular focus on configuration issues that are
unique to the computing environment at The University of Texas at Austin.

How to use the checklist


Print the checklist and check off each item you complete to ensure that you cover the critical steps for securing your server. The
Information Security Office uses this checklist during risk assessments as part of the process to verify that servers are secure.

How to read the checklist


Step - The step number in the procedure. If there is a UT Note for this step, the note number corresponds to the step number.
Check (√) - This is for administrators to check off when she/he completes this portion.
To Do - Basic instructions on what to do to harden the respective system
CIS - Reference number in the Center for Internet Security Windows Server 2008 Benchmark . The CIS document outlines in much
greater detail how to complete each step.
UT Note - The UT Note at the bottom of the page provides additional detail about the step for the university computing
environment.
Cat I - For systems that include Category-I data , required steps are denoted with the ! symbol. All steps are recommended.
Cat II/III - For systems that include Category-II or -III data , all steps are recommended, and some are required (denoted by the
!).
Min Std - This column links to the specific requirement for the university in the Minimum Security Standards for Systems
document.

Server Information
MAC Address

IP Address

Machine Name

Asset Tag

Administrator Name

Date

Step √ To Do CIS UT Cat I Cat II Min Std


Note Cat III

Preparation and Installation

1 If machine is a new install, protect it from hostile network traffic, until the § ! 5.1
operating system is installed and hardened.

2 Consider using the Security Configuration Wizard to assist in hardening §


the host.

Service Packs and Hotfixes

3 Install the latest service packs and hotfixes from Microsoft. § ! ! 5.2

4 Enable automatic notification of patch availability. 1.6.1 § ! !


Auditing and Account Policies

5 Configure Audit policy as described. 1.2 ! 6.1

6 Set minimum password length. 1.1.4 § !

7 Enable Password Complexity. 1.1.5 § !

8 Configure event Log Settings. 1.4 § ! 6.1

Security Settings

9 Disable anonymous SID/Name translation. (default) 1.9.6 !

10 Do not allow Anonymous Enumeration of SAM accounts (Default) 1.9.37 ! 5.5

11 Do not allow Anonymous Enumeration of SAM accounts and shares. 1.9.38 ! 5.5

12 Disable the guest account. (Default) 1.9.5 ! 5.12

13 Digitally Encrypt or Sign Secure Channel Data (Always). (Default) 1.9.12 5.6

14 Digitally Encrypt Secure Channel Data (When Possible). (Default) 1.9.13 ! 5.6

15 Digitally Sign Secure Channel Data (When Possible). (Default) 1.9.14 ! 5.6

16 Place the University warning banner in the Message Text for Users 1.9.27-28 § ! 5.10
Attempting to log on.

17 Disable the sending of unencrypted password to connect to Third-Party 1.9.32 ! 5.6


SMB Servers. (Default)

18 Do not allow Everyone permissions to apply to anonymous users. 1.9.40 ! 5.12


(Default)

19 Do not allow any named pipes to be accessed anonymously. 1.9.41 ! 5.12

20 Restrict anonymous access to Named Pipes and Shares. 1.9.43 ! 5.12

21 Ensure that no shares can be accessed anonymously. 1.9.44 ! 5.12

22 Choose "Classic" as the sharing and security model for local accounts. 1.9.45 ! 5.12
(Default)

23 Do not store LAN Manager hash values 1.9.46 ! 5.13

24 Set LAN Manager Authentication level to NTLMv2 only 1.9.47 ! 5.13

Additional Security Protection

25 Disable or uninstall unused services. ! 5.4

26 Disable or delete unused users. ! 5.4

27 Configure User Rights to be as secure as possible. 1.81 § !

28 Ensure all volumes are using the NTFS file system. § !

29 Use the Internet Connection Firewall or other methods to limit 1.5 § ! 5.5
connections to the server.

30 Configure file system permissions. § !

31 Configure registry permissions. § !

Additional Steps
32 Set the system date/time and configure it to synchronize against campus § !
time servers.

33 Install and enable anti-virus software. § ! ! 3.1

34 Install and enable anti-spyware software. § ! 3.2

35 Configure anti-virus software to update daily. § ! 3.3

36 Configure anti-spyware software to update daily. § ! 3.3

37 Configure a screen-saver to lock the console's screen automatically if §


the host is left unattended.

38 If the machine is not physically secured against unauthorized tampering, ! 4.1


set a BIOS/firmware password to prevent alterations in system startup
settings.

39 Configure the device boot order to prevent unauthorized booting from ! 4.1
alternate media.

40 Systems will provide secure storage for Category-I data as required by § ! 5.7
confidentiality, integrity, and availability needs. Security can be provided
by means such as, but not limited to, encryption, access controls,
filesystem audits, physically securing the storage media, or any
combination thereof as deemed appropriate.

41 Install software to check the integrity of critical operating system files. § ! 5.8

42 If RDP is utilized, set RDP connection encryption level to high. § ! 5.6

UT Note: Addendum

This list provides specific tasks related to the computing environment at The University of Texas at Austin.

1 If other alternatives are unavailable, this can be accomplished by installing a SOHO router/firewall in between the network
and the host to be protected.

2 The Security Configuration Wizard can greatly simplify the hardening of the server. Once the role for the host is defined,
the SCW can help create a system configuration based specifically on that role. It does not completely get rid of the need
to make other configuration changes, though. For more information, please see Security Configuration Wizard for Windows
Server 2008 .

3 There are several methods available to assist you in applying patches in a timely fashion: Microsoft Update Service

Microsoft Update checks your machine to identify missing patches and allows you to download and install them.
This is different than the "Windows Update" that is the default on Windows 2008. Microsoft Update includes updates
for many more Microsoft products, such as Office and Forefront Client Security.
This service is compatible with Internet Explorer only.

Windows AutoUpdate
ITS offers a Windows Server Update Services Server for campus use using Microsoft's own update servers. It
includes updates for additional Microsoft products, just like Microsoft Update, and provides additional administrative
control for software deployment.
Microsoft Baseline Security AnalyzerThis is a free host-based application that is available to download from
Microsoft . In addition to detailing missing patches, this tool also performs checks on basic security settings and
provides information on remediating any issues found.

4 Configure Automatic Updates from the Automatic Updates control panel

On most servers, you should choose either "Download updates for me, but let me choose when to install them," or
"Notify me but don't automatically download or install them."
The campus Windows Server Update Services server can be used as the source of automatic updates.
6 Configuring the minimum password length settings is important only if another method of ensuring compliance with university
password standards is not in place.

7 Configuring the password complexity setting is important only if another method of ensuring compliance with university
password standards is not in place.

8 The university requires the following event log settings instead of those recommended by the CIS Benchmark:

Maximum application log size---50000 KB


Maximum security log size---100000 KB
Maximum system log size---50000 KB
Prevent local guests group from accessing application log---enabled
Prevent local guests group from accessing security log---enabled
Prevent local guests group from accessing system log---enabled
Retention method for application log---Overwrite events older than 14 days
Retention method for security log---Overwrite events older that 14 days
Retention method for system log---Overwrite events older than 14 days

These are minimum requirements. The most important log here is the security log. 100 MB is a suggested minimum,
but if you have a high-volume service, make the file as large as necessary to make sure at least 14 days of security
logs are available. You may increase the number of days that you keep, or you may set the log files to not overwrite
events.
Note that if the event log reaches its maximum size and no events older than the number of days you specified exist
to be deleted or if you have disabled overwriting of events, no new events will be logged. This may happen
deliberately as an attempt by an attacker to cover his tracks. For critical services working with Cat 1 or other
sensitive data, you may wish to consider log shipping using syslog, Splunk, Intrust, or a similar service. Another
option is to configure Windows to rotate event log files automatically when an event log reaches its maximum size as
described in the article [Link] using the the AutoBackupLogFiles registry entry.

16 The text of the university's official warning banner can be found on the ITS Web site. You may add localized information to
the banner as long as the university banner is included.

27 Configure user rights to be as secure as possible. Every attempt should be made to remove Guest, Everyone, and
ANONYMOUS LOGON from the user rights lists.

28 Volumes formatted as FAT or FAT32 can be converted to NTFS, by using the [Link] utility provided by Microsoft.
Microsoft has provided instructions on how to perform the conversion
This conversion cannot be reversed.

29 IPSec is one method that can limit connections to the server, and it is another standard method by which communication
between servers can be encrypted.
IPSec configuration can be managed using the IP Security Policies Snap-In. More information can be found on the Microsoft
site.

30 Be extremely careful, as setting incorrect permissions on system files and folders can render a system unusable.

31 Be extremely careful, as setting incorrect permissions on registry entries can render a system unusable.

30 By default, domain members synchronize their time with domain controllers using Microsoft's Windows Time Service . The
domain controller should be configured to synchronize its time with an external time source, such as the university's network
time servers.
ITS Networking operates two stratum 2 NTPv4 (NTP version 4) servers for network time synchronization services for
university network administrators .

31 Download and install Microsoft Forefront Client Security from BevoWare .

32 Anti-spyware software is only required to be installed if the server is used to browse Web sites not specifically related to
the administration of the server. ITS provides anti-spyware software for no additional charge. At a minimum, SpyBot Search
and Destroy should be installed. We also recommend the installation of a secondary anti-spyware application, such as
SpyWare Blaster, EMS Free Surfer, or AdAware. Both SpyWare Blaster and EMS Free Surfer are available from
BevoWare.

An additional measure that can be taken is to install ?Firefox with the ?NoScript and ?Adblock Plus add-ons
33 Microsoft Forefront can be configured directly or through the use of GPOs . GPOs can simplify the management of multiple
servers.

34 Spyware Blaster — Enabling auto-update functionality requires the purchase of an additional subscription.
SpyBot Search and Destroy--Automatic update tasks can be created inside the program itself and are scheduled using
the Windows Task Scheduler.

1. In the Spybot Application, click on Mode-->Advanced View.


2. Click Settings on the left hand side of the window.
3. You should now see an option labeled "Scheduler." Select that option.
4. Adding the task to update automatically is relatively straightforward.
Click Add to create a task.
Click Edit to edit the task schedule.
In the Scheduled Task window that pops up, enter the following In the Run field:

"C:\Program Files\Spybot - Search & Destroy\[Link]" /AUTOUPDATE /TASKBARHIDE /AUTOCLOSE


Click the Schedule tab and choose a time for it to update. The duration of the update is very brief, but it is
processor intensive, so consider scheduling it to occur during periods of low usage. The task should be
scheduled daily.

37
1. Open the Display Properties control panel.
2. Select the Screen Saver tab.
3. Select a screen saver from the list. Although there are several available, consider using a simple one such as
"Blank."
4. The value for Wait should be no more than 30 minutes.
5. Select the On resume, password protect option.

40 Windows provides the Encrypting File System as a built-in mechanism to allow the encryption of individual users' files and
folders. Be aware of the caveats involved in the use of EFS before implementing it for general use, though. Other options
such as PGP , GNUPG , and [TrueCrypt ] also exist.
Another encryption option to consider is whole-disk encryption, which encrypts the entire contents of the drive instead of just
specific files and folders. Windows Vista and Windows 2008 come with BitLocker for this. TrueCrypt can also do whole-disk
encryption in addition to file-based encryption. ITS provides WinMagic SecureDoc which is recommended for encrypting
laptops.

We strongly recommend that, if encryption is being used in conjunction with Category I data, one of the solutions listed in
the Approved Encryption Methods (EID required) be implemented.

41 Windows Server 2008 has a feature called Windows Resource Protection which automatically checks certain key files and
replaces them if they become corrupted. It is enabled by default.
You can audit in much more in depth using Tripwire. Modern versions of Tripwire require the purchase of licenses in order to
use it. The Tripwire management console can be very helpful for managing more complex installations.

42 This setting is configured using the Terminal Services Configuration tool. On the General tab of the properties of the RDP
connection, select High from the list next to encryption level.

Copyright © 2001-2011 Information Technology Services. All rights reserved.

Common questions

Powered by AI

Configuring appropriate event log settings enhances server security by ensuring that all critical events are recorded and available for review, which aids in detecting and responding to unauthorized access attempts or system failures. The document recommends settings such as setting maximum log sizes (100 MB for the security log), and overwriting events older than 14 days to maintain a comprehensive yet manageable log history. Preventing local guest access to logs further secures this data. These settings ensure logs are detailed enough for forensic analysis while managing storage resources effectively .

The Security Configuration Wizard can simplify server hardening by guiding administrators through security configurations based on the server's role. It helps create a tailored security policy that matches the server's requirements and reduces manual configuration errors. However, it does not eliminate the need for further security measures and adjustments, as some configurations must still be manually reviewed and updated to ensure comprehensive security .

For enhanced security when using RDP, it's advised to set the connection encryption level to 'high,' which ensures that the data transmitted over RDP is adequately protected from interception. This setup mitigates risks associated with remote access by encrypting the traffic and making it more challenging for attackers to gain access to sensitive session data or protocol exploits .

Encryption is a critical component in securing data by transforming it into unreadable formats, which prevents unauthorized access and ensures data confidentiality and integrity. The document suggests methods like the Encrypting File System for individual files, BitLocker or TrueCrypt for whole-disk encryption, and WinMagic SecureDoc for laptops. Implementing encryption especially for Category I data is recommended, with a focus on using solutions from the list of approved encryption methods to ensure compliance with security standards .

Using a firewall helps to control traffic entering and leaving the server, thereby preventing unauthorized access and reducing attack surfaces. In conjunction with other security measures like IPSec, encryption, and regular patching, firewalls form a layered security approach that protects against external threats. This layering is critical, as it provides multiple points of defense against attacks and allows for greater flexibility in responding to evolving threats .

Configuring user rights and permissions is vital to prevent unauthorized access and privilege escalation. By carefully managing who has what rights, it reduces the risk of insider threats and limits the potential damage an attacker can cause if they gain access. Permissions should be minimized to the least privilege needed for each role. Misconfigurations can lead to significant vulnerabilities, potentially allowing unauthorized users to modify system settings, access sensitive data, or disrupt operations .

Disabling anonymous access to shares and named pipes is critical for preventing unauthorized users from accessing sensitive data and system resources. By restricting anonymous access, you ensure that only authenticated users can interact with the server, thereby reducing the risk of unauthorized data disclosure and potential misuse of system services. This measure is particularly important for environments handling sensitive data, as it helps mitigate potential attack vectors that could compromise data integrity and confidentiality .

Anti-virus and anti-spyware software are essential for detecting and mitigating threats posed by malware that could compromise system integrity and data confidentiality. It’s recommended to install and enable these applications, ensure they are updated daily, and perform regular scans. This proactive approach helps to minimize the risk of infections that could disrupt operations or lead to data breaches .

The NTFS file system provides improved security features over FAT or FAT32 by supporting file permissions, encryption, and larger volume capacities. Using NTFS allows administrators to implement detailed access controls and audits, protecting against unauthorized access and ensuring data integrity. Without NTFS, a server may be vulnerable to unauthorized actions that compromise data security, thus risking exposure of sensitive information .

Using the university's network time servers for synchronization ensures that all systems use a consistent and accurate time reference, which is crucial for logging events in a coordinated manner and facilitating forensic investigations. Accurate timestamps help in identifying and correlating security incidents across different systems. By synchronizing with trusted time sources, systems are protected from time-based attacks that could disrupt operations or obscure unauthorized activities .

You might also like