Contents
Overview
Welcome to the Windows Server 2008 Security Guide. This guide provides instructions and recommendations to help strengthen the security of computers running Windows Server® 2008 that are members of an Active Directory® domain.
In addition to the guidance that the Windows Server 2008 Security Guide prescribes, this Solution Accelerator provides tools, step-by-step procedures, recommendations, and processes that significantly streamline the deployment process. This guide not only provides you with effective security setting guidance. It also provides you with a reproducible method that you can use to apply the guidance to both test and production environments.
In order to create, test, and deploy the settings presented in this guide you must first run the Windows Installer (.msi) file for the Security Compliance Manager (SCM) tool that accompanies the download for this toolkit. You can then use this tool to view and customize the baselines to meet your organization’s unique requirements. You can also save baselines as Excel workbooks for documentation purposes. When a you have completed a baseline using the SCM tool, you can save it as a Group Policy Object (GPO) backup file that you can import into Active Directory Directory Services (AD DS) for further testing and ultimately for deployment in your production network. You can also use the SCM tool to export the baselines as Desired Configuration Management (DCM) Configuration Packs to use for compliance scanning with Microsoft® System Center Configuration Manager 2007. For instructions on how to use this tool to accomplish these tasks, see the information available in the Help Topics for the tool.
Microsoft engineering teams, consultants, support engineers, partners, and customers have reviewed and approved this prescriptive guidance to make it:
Proven. Based on field experience.
Authoritative. Offers the best advice available.
Accurate. Technically validated and tested.
Actionable. Provides the steps to success.
Relevant. Addresses real-world security concerns.
Microsoft has published security guides for Windows Server 2003 and Windows 2000 Server. This guide references significant security enhancements in Windows Server 2008. The guide was developed and tested with computers running Windows Server 2008 joined to a domain that uses Active Directory® Domain Services (AD DS).
As the operating system continues to evolve through future releases, you can expect updated versions of this guidance to include more security enhancements. Solution Accelerators are also available to assist you with the deployment and operation of Windows Server 2008. For more information about all available Solution Accelerators, visit Solution Accelerators on TechNet.
Executive Summary
IT security is everybody's business. Every day, adversaries are attempting to invade your networks and access your servers to bring them down, infect them with viruses, or steal information about your customers or employees. Attacks come from all directions: from onsite employee visits to Web sites infected with malware, to offsite employee connections through virtual private networks (VPNs), branch office network connections to corporate servers, or direct assaults on vulnerable computers or servers in your network. Organizations of all sizes now also face more complex and demanding audit requirements.
You know firsthand how essential your servers are to keeping your organization up and running. The data they house and the services they provide are your organization’s lifeblood. It is your job to stand guard over these essential assets, prevent them from going down or falling victim to attacks from outside and inside your organization, and to prove to auditors that you have taken all reasonable steps to secure your servers.
Windows Server 2008 is engineered from the ground up with security in mind, delivering an array of new and improved security technologies and features that provide a solid foundation for running and building your business. The Windows Server 2008 Security Guide is designed to further enhance the security of the servers in your organization by taking full advantage of the security features and options in Windows Server 2008.
This guide builds on the Windows Server 2003 Security Guide, which provides specific recommendations about how to harden servers running Windows Server 2003 Service Pack 2 (SP2). The Windows Server 2008 Security Guide provides recommendations to harden servers that use security baselines for the following two environments:
Enterprise Client (EC). Servers in this environment are located in a domain that uses AD DS and communicate with other servers running Windows Server 2008 or Windows Server 2003 SP2 or later. The client computers in this environment include a mixture: some run Windows Vista® SP1 whereas others run Windows XP Professional SP3 or later. For information about the baseline security settings that this environment uses, see the Windows Server 2008 Security Baseline Settings workbook.
Specialized Security – Limited Functionality (SSLF). Concern for security in this environment is so great that a significant loss of functionality and manageability is acceptable. For example, military and intelligence agency computers operate in this type of environment. The servers in this environment run only Windows Server 2008. For information about the SSLF settings that this environment uses, see the Windows Server 2008 Security Baseline Settings workbook.
 Caution The guidance in this chapter positions your organization to establish the SSLF environment, which is distinct from the EC environment. The SSLF guidance is for high security environments only. It is not a supplement to the guidance on the EC environment. Security settings prescribed for the SSLF environment limit key functionality across the environment. For this reason, the SSLF security baseline is not intended for most organizations. Be prepared to extensively test the SSLF security baseline before implementing it in a production environment.
The organization of the guide enables you to easily access the information that you require. The guide and its associated tools help you to:
Establish and deploy either of the security prescribed baselines in your network environment.
Identify and use Windows Server 2008 security features for common security scenarios.
Identify the purpose of each individual setting in either security baseline and understand their significance.
You will need to run the .msi file for the SCM tool that accompanies the download for this toolkit to create, test, and deploy settings for either the EC environment or the SSLF environment. You can use this tool to customize baselines and generate GPO backup files for applying the settings to users and computers. For instructions on how to use this tool to accomplish these tasks, see the information available in the Help Topics for the tool.
This guide is designed primarily for enterprise customers. To obtain the most value from this material, you will need to read the entire guide. However, it is possible to read individual portions of the guide to achieve specific aims. The "Chapter Summaries" section in this overview briefly introduces the information in the guide. For further information about security topics and settings related to Windows Server 2008, see the Windows Server 2008 Security Baseline Settings workbook and the companion guide, Threats and Countermeasures.
After deploying the appropriate security settings across your enterprise you can verify that the settings are in effect on each computer using the Security Compliance Management Toolkit. The toolkit includes Configuration Packs that match the recommendations in this guide for the EC and SSLF environments. The toolkit can be used with the Desired Configuration Management (DCM) feature in Configuration Manager 2007® (SP1) to efficiently monitor compliance. In addition, you can quickly and easily run reports to demonstrate how your organization is meeting important compliance regulations. For further information about the toolkit, see Security Compliance Management Toolkit on TechNet.
Who Should Read This Guide
The Windows Server 2008 Security Guide is primarily for IT professionals, security specialists, network architects, computer engineers, and other IT consultants who plan application or infrastructure development and deployments of Windows Server 2008 for servers in an enterprise environment. The guide is not intended for home users. This guide is for individuals whose jobs may include one for more of the following roles:
Security specialist. Users in this role focus on how to provide security across computing platforms within an organization. Security specialists require a reliable reference guide that addresses the security needs of every level of the organization and also offers proven methods to implement security countermeasures. Security specialists identify security features and settings, and then provide recommendations on how their customers can most effectively use them in high risk environments.
IT operations, help desk, and deployment staff. Users in IT operations focus on integrating security and controlling change in the deployment process, whereas deployment staff focuses on administering security updates quickly. Staff in these roles also troubleshoot security issues related to applications that involve how to install, configure, and improve the usability and manageability of software. They monitor these types of issues to define measurable security improvements and a minimum of impact on critical business applications.
Network architect and planner. Users in this role drive the network architecture efforts for computers in their organizations.
Consultant. Users in this role are aware of security scenarios that span all the business levels of an organization. IT consultants from both Microsoft Services and partners take advantage of knowledge transfer tools for enterprise customers and partners.
|
