- Microsoft Antivirus For Server 2003 Download
- Microsoft Antivirus For Server 2003 Free
- Microsoft Antivirus For Windows Server 2003 Free Download
- Windows Server 2003 Antivirus Software
- Microsoft offered a group of antivirus definition updates in SCEP and FEP (System Center Endpoint Protection (SCEP) and Forefront Endpoint Protection (FEP) ) that crashed XP and Server 2003 systems worldwide. Sysadmins complained on TechNet that large numbers of XP machines were screwed after installing the update.
- Avg Antivirus For Server 2003 Kaspersky Antivirus For Server 2003 NOTES: For a long-term security solution on Windows Server 2003 SP2, consider McAfee Application Control for Servers.
Contact McAfee Sales for further information. McAfee strongly advises its customers to upgrade to a later version of Microsoft Windows OS to ensure the best level of security coverage by its products. Antivirus on Windows Server 2003. We used to install a anivirus software but it doesnt run with WS 2003.
No Alerts at this time.
E-mail: security@lbl.gov
Checklist for Securing Windows Server 2003
Overview
Microsoft's Windows Server 2003 (WS2003) was developed in accordance with Microsoft's Trusted Computing Initiative (TCI), in which security engineering was incorporated into the software development process. One very positive consequence is that WS2003 is the most secure out-of-the-box operating system (OS) that Microsoft has made. Downfalls from a security perspective include the fact that numerous group-policy parameters that affect security are not set by default, and that a large number of vulnerabilities have surfaced since this OS was first released. The purpose of these guidelines is to describe baseline security measures for securing WS2003.
Scope
The WS2003 OS consists of a number of separate but related versions:
- WS2003, Standard Edition — the 'standard' server
- WS2003 64-Bit Edition — a server built to support 64-bit applications
- WS2003, Enterprise Edition — a high-ended version of this OS that allows clusters, boots from a Storage Area Network (SAN), has hot-install memory, and much more
- WS2003, Web Edition — a version that is specifically tailored to be only a Web server
- WS2003, Datacenter Edition — large amounts of RAM, tailored for data mining
Note: These guidelines apply only to the standard, 64-bit, and enterprise editions.
Baseline Security Measures
Microsoft Antivirus For Server 2003 Download
Establishing at least a baseline level of security is essential if WS2003 workstations and servers are going to be to defend themselves against basic attacks launched against Windows systems. Putting the following countermeasures in place will result in a baseline level of security:
- Ensure that your system's hard drive consists of at least two partitions, C and D. Use C as the system drive; this partition should contain critical system directories and files. Do not set up user shares to this partition. In member servers, use the D: partition to hold other files and folders; set up user shares to D: as needed. In domain controllers, use D to hold Active Directory files and folders (such as the ntds and sysvol folders); do not set up user shares to D. Set up drive E in domain controllers to hold user files and folders. If users should need access to resources on domain controllers (something that is not advisable from a security perspective), set up user shares to drive E.
Format each partition as an NTFS partition.1 If any volume is FAT-formatted, enter:
For instance, to convert partition D: to be an NTFS partition, enter:
- Download the Microsoft Baseline Security Analyzer (MBSA) for WS2003 from . Run this tool once a week and install any missing hotfixes by going and following the instructions. (Note: Although Windows Updates are fine for workstations, they are not recommended for servers such as WS2003 systems because of the potential for damage or disruption of service from downloading flawed hotfixes.)
- Ensure that your Windows Server 2003 system is part of a domain.2 Your alternative is to have your machine belong to a workgroup, something that is very dangerous given that whoever discovers the name of a workgroup can make a hostile machine a member of that workgroup, then attack other systems within that workgroup. Workgroups provide almost no barriers to attackers. To check whether your system is part of a domain or workgroup, right click on My Computer to Properties and then click on Computer Name. For information concerning how to join a domain at LBNL, contact Curtis McDonald, cjmcdonald@lbl.gov. There is no charge for joining the central LBL domain.
- Ensure that file permissions on the system drive (and, in the case of domain controllers, the drive on which Active Directory resides) are appropriate. In general, do not assign anything more than Read-Execute permissions to Authenticated Users, but always assign Full Control to Creator Owner and Administrators.Assign Everyone Read-Execute access to C:%systemroot% (which by default is C:Windows), C:%systemroot%system 32. In Domain Controllers (DCs) ensure that Authenticated Users do not have more than Read-Execute access to the sysvol, sysvolsysvol, and ntds folders (wherever they reside in the file system). Do not assign any access permissions to the Everyone group. Remove any access (but do not assign No Access) that this group has. This is especially important in the case of C:%systemroot%repair, where a backup copy of the password file resides. To check each permission use the Windows Explorer to locate a file or folder. Right click on the icon for the file or folder to Properties -> Security.
- Avoid sharing folders or partitions if you do not need to do so. For each share, allow Creator Owner and Administrator to have Full Control and then assign Authenticated Users the Read (default) or Change (if writing and deleting files is necessary) level of share access. To check or change share permissions or to delete shares, go from Start -> Administrative Tools -> Computer Management -> System Tools -> Shared Folders -> Shares. Highlight the share you want to get to, then right click to Properties. You can right click to Stop Sharing if you do not need the share or right click to Properties to change its permissions if they are inappropriate.
Disable automatic generation of 8.3 File Names. Use of 8.3 file naming (a legacy mechanism from the FAT file system) can permit users to get to files and folders without authorization. Using a Registry editor such as regedt32 (by going Start -> Run and entering regedt32), add a value, NtfsDisable8dot3NameCreation, to the following Registry key:
Assign a numerical value of 1 and a type of REG_DWORD.
- Rename the default Administrator account to a name that does not give away the fact that this is a privileged account.3 Change the account description to 'User account.' Enter a ridiculously long (up to 104 characters) and as difficult to guess a password as possible. Write the password down on the piece of paper that you keep in your personal possession, e.g., in your wallet or purse whenever you are at work. Never share this password with others and do not leave the slip of paper on which this password is written anywhere where others might see it. Use the default Administrator account only for emergency access. Create one additional account that is a member of the Administrators group for yourself and another for each person who needs to administer your system. Create an unprivileged account for each Administrator, also. Use the unprivileged account when you are engaged in normal activities such as Web surfing, obtaining FTP access, and downloading mail. Use the superuser account only when you are involved in system administration duties. To do this in member servers, go from Start -> Administrative Tools -> Computer Management -> Local Users and Groups -> Users and then right click on Administrator to Properties. To do this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Active Directory Users and Computers -> Local Users and Groups -> Users and then right click on Administrator.
- Create a new, unprivileged account named 'Administrator.' Ensure that this account is in the Guest group only. Look at your logs frequently to determine whether people are trying to logon to this account, which is a decoy account designed to deflect genuine attacks against your system. To do this in member servers, go from Start -> Administrative Tools -> Computer Management -> Local Users and Groups -> Users and then right click on Administrator. To do this in DCs, go from Start -> Administrative Tools -> Active Directory Users and Computers -> and right click to New -> User.
- Leave the Guest account disabled. To do this in member servers, go from Start -> Administrative Tools -> Computer Management -> Local Users and Groups -> Users and then right click on Guest to Properties. To do this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Active Directory Users and Computers -> Local Users and Groups -> Users and then right click on Guest to Properties.
- Drastically limit the membership in the Enterprise Admins, Schema Admins, and Administrator groups, all of which have almost unlimited power. This applies only to DCs. To check this in DCs, go from Start -> All Programs -> Administrative Tools -> Domain Security Policy -> Active Directory Users and Computers -> Local Users and Groups -> Builtin.
- Drastically limit the member in the Local Administrators group. To check this in member servers, go from Start -> Administrative Tools -> Computer Management -> Local Users and Groups -> Builtin. Right click on Administrators -> Properties -> Members. To do this in DCs, go from Start -> Administrative Tools -> Active Directory Users and Computers -> Local Users and Groups -> Builtin. Right click on Administrators -> Properties -> Members.
Set the following Account Options for each account:
User must change password at next logon.
Yes (checked)
User cannot change password.
No (not checked)
Password never expires.
No (not checked)
Account is disabled.
No (except for the Guest and Support accounts)4
Store password using reversible encryption^5^
Yes (unless low ended clients such as W9X machines connect to this host)
To do this in member servers, go from Start -> Administrative Tools -> Computer Management -> Local Users and Groups -> Users and then right click on Guest to Properties. To do this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Active Directory Users and Computers -> Local Users and Groups -> Users and then right click on Guest to Properties.Set the following Password Policy values:
Enforce password history
24
Maximum password age
180 days
Minimum password age
1 day
Minimum password length
8
Passwords must meet complexity requirements
Enabled
Store passwords using reversible encryption
Yes (unless low-ended clients such as W9X machines connect to this host)
To set or check these parameters in member servers, go from Start -> Administrative Tools -> Local Security Policy -> Security Settings -> Account Policies -> Password Policy. To check this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Security Settings -> Account Policies -> Password Policy.Set the following Account Lockout parameters:
Account lockout duration
60 min.
Account lockout threshold
5 invalid logon attempts
Reset account lockout counter after
60 min.
To set or check these parameters in member servers, go from Start -> Administrative Tools -> Local Security Policy -> Security Settings -> Account Policies -> Account Lockout Policy. To check this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Security Settings -> Account Policies -> Account Lockout Policy.Enable the following Audit Policy settings.
Audit account logon events
Success/Failure
Audit account management
Success/Failure
Audit directory service access (but only if host is a DC)
Success/Failure
Audit logon events
Success/Failure
Audit policy change
Success/Failure
Audit privilege use
Success/Failure
To set these parameters in member servers, go from Start -> Administrative Tools -> Local Security Policy -> Security Settings -> Local Policies -> Audit Policy. To check this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Security Settings -> Local Policies -> Audit Policy.Enable the following Event Log settings for the security log:
Maximum security log size
16384 kilobytes
Prevent local guests group from accessing security log
Enabled
Retain security log
Not defined
Retention method for security log
Overwrite events as needed
To set these parameters in member servers, go from Start -> Administrative Tools -> Local Security Policy -> Security Settings -> Event Log. To check this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Security Settings -> Event Log.- Ensure at a minimum that the no unprivileged group such as Authenticated Users and Everyone has any of the following rights:
To check these parameters in member servers, go from Start -> Administrative Tools -> Local Security Policy -> Security Settings -> Event Log. To check this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Security Settings -> Event Log.–Act as part of the operating system
–Add workstations to domain
–Backup files and directories
–Create a pagefile
–Create a token object
–Debug programs
–Enable computer and user accounts to be trusted for delegation
–Force shutdown from a remote system
–Increase quotas
–Increase scheduling priority
–Load and unload device drivers
–Lock pages in memory
–Logon as a batch job
–Logon as a service
–Logon locally
–Manage auditing and security log
–Modify firmware environment variables
–Replace a process-level token
–Restore files and directories
–Shut down the system
–Synchronize directory service data
–Take ownership of files and other objects - Enable the following Security Options (or ensure that they are enabled):
–Accounts: Guest account status (Guest account should be disabled)
–Audit: Audit the use of backup and restore privilege
–Devices: Prevent users from installing print drivers
–Devices: Restrict floppy access to locally logged on user only
–Domain Member: Digitally encrypt or sign channel data (when possible)
–Domain member: Maximum password account password age
–Domain member: Require strong session key
–Interactive logon: Message text for users attempting to logon
–Interactive logon: Message title for users attempting to logon
–Interactive logon: Prompt user to change password before expiration
–Interactive logon: Require Domain Controller authentication to unlock workstation
–Microsoft network server: Amount of idle time required before suspending session
–Network access: Do not allow anonymous enumeration of SAM accounts and shares
–Network access: Restrict anonymous access to Named Pipes and Shares
–Network access: Sharing and security model for local accounts (Choose Classic-local users authenticate as themselves)
–Network security: Do not store LAN Manager hash value on next password change (choose Send NTLMv2 response onlyrefuse LM, but only if clients are all W2K/WXP)
–Network security: LAN Manager authentication level
–Network security: Minimum session security for NTLM SSP based (including secure RPC) clients
–Shutdown: Clear virtual memory page file
–System cryptography: Force strong key protection for user keys stored on the computer
–System objects: Default owner for objects created by members of the Administrators group
–System objects: Require case insensitivity for non-Windows subsystems
–System objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links)
Do not enable:
To set or check these parameters in member servers, go from Start -> Administrative Tools -> Local Security Policy -> Security Settings -> Local Policies -> Security Options. To check this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Security Settings -> Local Policies -> Security Options.–Accounts: Limit local use of blank passwords to local logons only
–Audit: Shut down system immediately if unable to log security audits
–Devices: Unsigned driver installation behavior
–Domain Controller: Allow server operators to schedule tasks
–Network access: Let Everyone permissions apply to anonymous users
–Recovery console: Allow automatic administrative logon
–Recovery console: Allow floppy copy and access to all drives and all folders - Ensure that the bare number of services—only the services that you genuinely need--are running. The following are services that are usually not needed in WS2003:
Disable any unnecessary services in member servers by going from Start -> Administrative Tools -> System Services. Highlight the name of each unnecessary service, double click and then under Service Status click on Stop and under Startup Type set this to Disabled. In DCs go from Start -> Administrative Tools -> Domain Controller Security Policy -> Security Settings -> System Services instead.–Alerter
–Computer Browser
–IIS Admin Service (this is needed for IIS Web servers and IIS-based FTP)
–Indexing Service
–Messenger
–Print Spooler (except when there is a local printer or when you add a remote printer)
–Routing and Remote Access
–Simple TCP Services
–Telnet
–Windows Installer (should be enabled only during software installations)
–Worldwide Web Publishing (this is needed for IIS Web servers) - Use the built-in firewall to ensure that any of the following services that you do not need to offer to other systems cannot be reached:
–FTP server
–Internet Mail Access Protocol Version 3 (IMAP3)
–Internet Mail Access Protocol Version 3 (IMAP4)
–Internet Mail Server (SMTP)
–Remote Desktop
–Secure Web Server (HTTPS)
–Telnet Server
–Web Server (HTTP) - Set software policy restrictions for types of files that you do not want executed (e.g., JPG and SCR files) and paths in your file system and Registry that you do not want executables to reach. Go from Start -> Administrative Tools -> Active Directory Users and Computers. In the console tree right-click an OU. Right click to Properties and click the Group Policy tab. Click a GPO in Group Policy Object Links and click Edit (or create a new GPO) In the console tree, go to Group Policy Object Policy/Computer Configuration or User Configuration/Windows Settings/Security Settings/Software Restriction Policies
- Be sure to run Symantec AntiVirus on your system, and to keep its signatures updated every day. To check whether you have Symantec AV, go to Programs. If Symantec AntiVirus is one of the selections, your system is running this program. Go to download Symantec AV. To update Symantec AV, go from Start to Programs to Symantec AntiVirus Corporate Edition to Symantec AntiVirus Corporate Edition to Live Update. Click on Live Update and follow the instructions. You will now have the latest updates to Symantec AntiVirus, which is the best all-around defense against virus and worm infections.
Conclusion
As mentioned earlier, these guidelines are designed to provide a baseline level of security in WS2003. If you implement these settings and procedures, your WS2003 system, go to install a free copy of Norton anti-virus software; if you keep this software updated, your system will be able to resist most attacks launched against it.
References
De Clercq, J., Windows Server 2003 Security Infrastructures : Core Security Features. Herndon, VA: Digital Press, 2004.
Microsoft Antivirus For Server 2003 Free
Jones, D. & Rouse, M., Microsoft Windows Server 2003. Indianapolis: SAMS, 2003
Microsoft Corporation, Windows Sever 2003 Security Guide. http://www.microsoft.com/technet/security/prodtech/win2003/w2003hg/sgch00.mspx
Minasi, M., Anderson, C., Beveridge, M., Callahan, C.A., & Justice, L. Windows Server 2003. San Francisco: Sybex, 2003.
Rampling, B., Windows Server 2003 Security Bible. New York: Wiley, 2002.
Ruest, D. & Ruest, N., Windows Server 2003: Best Practices for Enterprise Deployments. Berkeley, CA: Osborne, 2003.
Scambray, J. & McClure, S., Windows Server 2003 Hacking Exposed. Berkeley, CA: Osborne, 2003.
Smith, R.F., Unwrapping Win2003. Information Security Magazine, April 2003. http://www.infosecuritymag.com/2003/apr/cover.shtml
Microsoft Antivirus For Windows Server 2003 Free Download
Stanek, W.R., Microsoft Windows Server 2003. Redmond, WA: Microsoft Press, 2003.
Notes
- WS2003, Web Edition — a version that is specifically tailored to be only a Web server
- WS2003, Datacenter Edition — large amounts of RAM, tailored for data mining
Note: These guidelines apply only to the standard, 64-bit, and enterprise editions.
Baseline Security Measures
Microsoft Antivirus For Server 2003 Download
Establishing at least a baseline level of security is essential if WS2003 workstations and servers are going to be to defend themselves against basic attacks launched against Windows systems. Putting the following countermeasures in place will result in a baseline level of security:
- Ensure that your system's hard drive consists of at least two partitions, C and D. Use C as the system drive; this partition should contain critical system directories and files. Do not set up user shares to this partition. In member servers, use the D: partition to hold other files and folders; set up user shares to D: as needed. In domain controllers, use D to hold Active Directory files and folders (such as the ntds and sysvol folders); do not set up user shares to D. Set up drive E in domain controllers to hold user files and folders. If users should need access to resources on domain controllers (something that is not advisable from a security perspective), set up user shares to drive E.
Format each partition as an NTFS partition.1 If any volume is FAT-formatted, enter:
For instance, to convert partition D: to be an NTFS partition, enter:
- Download the Microsoft Baseline Security Analyzer (MBSA) for WS2003 from . Run this tool once a week and install any missing hotfixes by going and following the instructions. (Note: Although Windows Updates are fine for workstations, they are not recommended for servers such as WS2003 systems because of the potential for damage or disruption of service from downloading flawed hotfixes.)
- Ensure that your Windows Server 2003 system is part of a domain.2 Your alternative is to have your machine belong to a workgroup, something that is very dangerous given that whoever discovers the name of a workgroup can make a hostile machine a member of that workgroup, then attack other systems within that workgroup. Workgroups provide almost no barriers to attackers. To check whether your system is part of a domain or workgroup, right click on My Computer to Properties and then click on Computer Name. For information concerning how to join a domain at LBNL, contact Curtis McDonald, cjmcdonald@lbl.gov. There is no charge for joining the central LBL domain.
- Ensure that file permissions on the system drive (and, in the case of domain controllers, the drive on which Active Directory resides) are appropriate. In general, do not assign anything more than Read-Execute permissions to Authenticated Users, but always assign Full Control to Creator Owner and Administrators.Assign Everyone Read-Execute access to C:%systemroot% (which by default is C:Windows), C:%systemroot%system 32. In Domain Controllers (DCs) ensure that Authenticated Users do not have more than Read-Execute access to the sysvol, sysvolsysvol, and ntds folders (wherever they reside in the file system). Do not assign any access permissions to the Everyone group. Remove any access (but do not assign No Access) that this group has. This is especially important in the case of C:%systemroot%repair, where a backup copy of the password file resides. To check each permission use the Windows Explorer to locate a file or folder. Right click on the icon for the file or folder to Properties -> Security.
- Avoid sharing folders or partitions if you do not need to do so. For each share, allow Creator Owner and Administrator to have Full Control and then assign Authenticated Users the Read (default) or Change (if writing and deleting files is necessary) level of share access. To check or change share permissions or to delete shares, go from Start -> Administrative Tools -> Computer Management -> System Tools -> Shared Folders -> Shares. Highlight the share you want to get to, then right click to Properties. You can right click to Stop Sharing if you do not need the share or right click to Properties to change its permissions if they are inappropriate.
Disable automatic generation of 8.3 File Names. Use of 8.3 file naming (a legacy mechanism from the FAT file system) can permit users to get to files and folders without authorization. Using a Registry editor such as regedt32 (by going Start -> Run and entering regedt32), add a value, NtfsDisable8dot3NameCreation, to the following Registry key:
Assign a numerical value of 1 and a type of REG_DWORD.
- Rename the default Administrator account to a name that does not give away the fact that this is a privileged account.3 Change the account description to 'User account.' Enter a ridiculously long (up to 104 characters) and as difficult to guess a password as possible. Write the password down on the piece of paper that you keep in your personal possession, e.g., in your wallet or purse whenever you are at work. Never share this password with others and do not leave the slip of paper on which this password is written anywhere where others might see it. Use the default Administrator account only for emergency access. Create one additional account that is a member of the Administrators group for yourself and another for each person who needs to administer your system. Create an unprivileged account for each Administrator, also. Use the unprivileged account when you are engaged in normal activities such as Web surfing, obtaining FTP access, and downloading mail. Use the superuser account only when you are involved in system administration duties. To do this in member servers, go from Start -> Administrative Tools -> Computer Management -> Local Users and Groups -> Users and then right click on Administrator to Properties. To do this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Active Directory Users and Computers -> Local Users and Groups -> Users and then right click on Administrator.
- Create a new, unprivileged account named 'Administrator.' Ensure that this account is in the Guest group only. Look at your logs frequently to determine whether people are trying to logon to this account, which is a decoy account designed to deflect genuine attacks against your system. To do this in member servers, go from Start -> Administrative Tools -> Computer Management -> Local Users and Groups -> Users and then right click on Administrator. To do this in DCs, go from Start -> Administrative Tools -> Active Directory Users and Computers -> and right click to New -> User.
- Leave the Guest account disabled. To do this in member servers, go from Start -> Administrative Tools -> Computer Management -> Local Users and Groups -> Users and then right click on Guest to Properties. To do this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Active Directory Users and Computers -> Local Users and Groups -> Users and then right click on Guest to Properties.
- Drastically limit the membership in the Enterprise Admins, Schema Admins, and Administrator groups, all of which have almost unlimited power. This applies only to DCs. To check this in DCs, go from Start -> All Programs -> Administrative Tools -> Domain Security Policy -> Active Directory Users and Computers -> Local Users and Groups -> Builtin.
- Drastically limit the member in the Local Administrators group. To check this in member servers, go from Start -> Administrative Tools -> Computer Management -> Local Users and Groups -> Builtin. Right click on Administrators -> Properties -> Members. To do this in DCs, go from Start -> Administrative Tools -> Active Directory Users and Computers -> Local Users and Groups -> Builtin. Right click on Administrators -> Properties -> Members.
Set the following Account Options for each account:
User must change password at next logon.
Yes (checked)
User cannot change password.
No (not checked)
Password never expires.
No (not checked)
Account is disabled.
No (except for the Guest and Support accounts)4
Store password using reversible encryption^5^
Yes (unless low ended clients such as W9X machines connect to this host)
To do this in member servers, go from Start -> Administrative Tools -> Computer Management -> Local Users and Groups -> Users and then right click on Guest to Properties. To do this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Active Directory Users and Computers -> Local Users and Groups -> Users and then right click on Guest to Properties.Set the following Password Policy values:
Enforce password history
24
Maximum password age
180 days
Minimum password age
1 day
Minimum password length
8
Passwords must meet complexity requirements
Enabled
Store passwords using reversible encryption
Yes (unless low-ended clients such as W9X machines connect to this host)
To set or check these parameters in member servers, go from Start -> Administrative Tools -> Local Security Policy -> Security Settings -> Account Policies -> Password Policy. To check this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Security Settings -> Account Policies -> Password Policy.Set the following Account Lockout parameters:
Account lockout duration
60 min.
Account lockout threshold
5 invalid logon attempts
Reset account lockout counter after
60 min.
To set or check these parameters in member servers, go from Start -> Administrative Tools -> Local Security Policy -> Security Settings -> Account Policies -> Account Lockout Policy. To check this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Security Settings -> Account Policies -> Account Lockout Policy.Enable the following Audit Policy settings.
Audit account logon events
Success/Failure
Audit account management
Success/Failure
Audit directory service access (but only if host is a DC)
Success/Failure
Audit logon events
Success/Failure
Audit policy change
Success/Failure
Audit privilege use
Success/Failure
To set these parameters in member servers, go from Start -> Administrative Tools -> Local Security Policy -> Security Settings -> Local Policies -> Audit Policy. To check this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Security Settings -> Local Policies -> Audit Policy.Enable the following Event Log settings for the security log:
Maximum security log size
16384 kilobytes
Prevent local guests group from accessing security log
Enabled
Retain security log
Not defined
Retention method for security log
Overwrite events as needed
To set these parameters in member servers, go from Start -> Administrative Tools -> Local Security Policy -> Security Settings -> Event Log. To check this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Security Settings -> Event Log.- Ensure at a minimum that the no unprivileged group such as Authenticated Users and Everyone has any of the following rights:
To check these parameters in member servers, go from Start -> Administrative Tools -> Local Security Policy -> Security Settings -> Event Log. To check this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Security Settings -> Event Log.–Act as part of the operating system
–Add workstations to domain
–Backup files and directories
–Create a pagefile
–Create a token object
–Debug programs
–Enable computer and user accounts to be trusted for delegation
–Force shutdown from a remote system
–Increase quotas
–Increase scheduling priority
–Load and unload device drivers
–Lock pages in memory
–Logon as a batch job
–Logon as a service
–Logon locally
–Manage auditing and security log
–Modify firmware environment variables
–Replace a process-level token
–Restore files and directories
–Shut down the system
–Synchronize directory service data
–Take ownership of files and other objects - Enable the following Security Options (or ensure that they are enabled):
–Accounts: Guest account status (Guest account should be disabled)
–Audit: Audit the use of backup and restore privilege
–Devices: Prevent users from installing print drivers
–Devices: Restrict floppy access to locally logged on user only
–Domain Member: Digitally encrypt or sign channel data (when possible)
–Domain member: Maximum password account password age
–Domain member: Require strong session key
–Interactive logon: Message text for users attempting to logon
–Interactive logon: Message title for users attempting to logon
–Interactive logon: Prompt user to change password before expiration
–Interactive logon: Require Domain Controller authentication to unlock workstation
–Microsoft network server: Amount of idle time required before suspending session
–Network access: Do not allow anonymous enumeration of SAM accounts and shares
–Network access: Restrict anonymous access to Named Pipes and Shares
–Network access: Sharing and security model for local accounts (Choose Classic-local users authenticate as themselves)
–Network security: Do not store LAN Manager hash value on next password change (choose Send NTLMv2 response onlyrefuse LM, but only if clients are all W2K/WXP)
–Network security: LAN Manager authentication level
–Network security: Minimum session security for NTLM SSP based (including secure RPC) clients
–Shutdown: Clear virtual memory page file
–System cryptography: Force strong key protection for user keys stored on the computer
–System objects: Default owner for objects created by members of the Administrators group
–System objects: Require case insensitivity for non-Windows subsystems
–System objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links)
Do not enable:
To set or check these parameters in member servers, go from Start -> Administrative Tools -> Local Security Policy -> Security Settings -> Local Policies -> Security Options. To check this in DCs, go from Start -> Administrative Tools -> Domain Security Policy -> Security Settings -> Local Policies -> Security Options.–Accounts: Limit local use of blank passwords to local logons only
–Audit: Shut down system immediately if unable to log security audits
–Devices: Unsigned driver installation behavior
–Domain Controller: Allow server operators to schedule tasks
–Network access: Let Everyone permissions apply to anonymous users
–Recovery console: Allow automatic administrative logon
–Recovery console: Allow floppy copy and access to all drives and all folders - Ensure that the bare number of services—only the services that you genuinely need--are running. The following are services that are usually not needed in WS2003:
Disable any unnecessary services in member servers by going from Start -> Administrative Tools -> System Services. Highlight the name of each unnecessary service, double click and then under Service Status click on Stop and under Startup Type set this to Disabled. In DCs go from Start -> Administrative Tools -> Domain Controller Security Policy -> Security Settings -> System Services instead.–Alerter
–Computer Browser
–IIS Admin Service (this is needed for IIS Web servers and IIS-based FTP)
–Indexing Service
–Messenger
–Print Spooler (except when there is a local printer or when you add a remote printer)
–Routing and Remote Access
–Simple TCP Services
–Telnet
–Windows Installer (should be enabled only during software installations)
–Worldwide Web Publishing (this is needed for IIS Web servers) - Use the built-in firewall to ensure that any of the following services that you do not need to offer to other systems cannot be reached:
–FTP server
–Internet Mail Access Protocol Version 3 (IMAP3)
–Internet Mail Access Protocol Version 3 (IMAP4)
–Internet Mail Server (SMTP)
–Remote Desktop
–Secure Web Server (HTTPS)
–Telnet Server
–Web Server (HTTP) - Set software policy restrictions for types of files that you do not want executed (e.g., JPG and SCR files) and paths in your file system and Registry that you do not want executables to reach. Go from Start -> Administrative Tools -> Active Directory Users and Computers. In the console tree right-click an OU. Right click to Properties and click the Group Policy tab. Click a GPO in Group Policy Object Links and click Edit (or create a new GPO) In the console tree, go to Group Policy Object Policy/Computer Configuration or User Configuration/Windows Settings/Security Settings/Software Restriction Policies
- Be sure to run Symantec AntiVirus on your system, and to keep its signatures updated every day. To check whether you have Symantec AV, go to Programs. If Symantec AntiVirus is one of the selections, your system is running this program. Go to download Symantec AV. To update Symantec AV, go from Start to Programs to Symantec AntiVirus Corporate Edition to Symantec AntiVirus Corporate Edition to Live Update. Click on Live Update and follow the instructions. You will now have the latest updates to Symantec AntiVirus, which is the best all-around defense against virus and worm infections.
Conclusion
As mentioned earlier, these guidelines are designed to provide a baseline level of security in WS2003. If you implement these settings and procedures, your WS2003 system, go to install a free copy of Norton anti-virus software; if you keep this software updated, your system will be able to resist most attacks launched against it.
References
De Clercq, J., Windows Server 2003 Security Infrastructures : Core Security Features. Herndon, VA: Digital Press, 2004.
Microsoft Antivirus For Server 2003 Free
Jones, D. & Rouse, M., Microsoft Windows Server 2003. Indianapolis: SAMS, 2003
Microsoft Corporation, Windows Sever 2003 Security Guide. http://www.microsoft.com/technet/security/prodtech/win2003/w2003hg/sgch00.mspx
Minasi, M., Anderson, C., Beveridge, M., Callahan, C.A., & Justice, L. Windows Server 2003. San Francisco: Sybex, 2003.
Rampling, B., Windows Server 2003 Security Bible. New York: Wiley, 2002.
Ruest, D. & Ruest, N., Windows Server 2003: Best Practices for Enterprise Deployments. Berkeley, CA: Osborne, 2003.
Scambray, J. & McClure, S., Windows Server 2003 Hacking Exposed. Berkeley, CA: Osborne, 2003.
Smith, R.F., Unwrapping Win2003. Information Security Magazine, April 2003. http://www.infosecuritymag.com/2003/apr/cover.shtml
Microsoft Antivirus For Windows Server 2003 Free Download
Stanek, W.R., Microsoft Windows Server 2003. Redmond, WA: Microsoft Press, 2003.
Notes
Windows Server 2003 Antivirus Software
- The only potential limitation is that 16-bit applications are likely to break if they are installed on NTFS partitions. If you have 16-bit applications that need to run in the WS2003 environment, create another, small FAT32 partition for these applications. But do not jeopardize other applications by putting them on a FAT32 partition — FAT32 has no access permissions whatsoever.
- If your WS2003 system is a DC, use the Domain Security Policy settings (or possible the group policy settings for Organizational Units (OUs) to set your security policy settings. Domain policy settings prevail over local policy settings, as do OU policy settings.
- To do this you will need to enable a Security Option setting, 'Rename Administrator Account.' Dealing with Security Options will soon be covered.
- If your WS2003 host is not a web server, you should also disable IIS_WPG, IUSR_, and UWAM_.
- Reversible encryption is the weaker form of encryption (based on the much maligned DES encryption algorithm) in WS2003. If no other system needs to connect to shares or to authenticate to your system, you can choose No for this setting, which is something that is much better for security. But if other systems need share or authentication connections, you would do better to choose Yes here to prevent unnecessary disruption of service and functionality.
Symantec is committed to providing the best possible security for its customers. Even as Microsoft stops publishing new functionality and security updates for Server 2003, Symantec will continue to release 32-bit and 64-bit definition sets that are compatible across all 32-bit and 64-bit Windows platforms supported by the product.
Current releases of Symantec Endpoint Protection (SEP) 12.1 support Server 2003, and continued maintenance and feature releases in the foreseeable future are planned to include support. Symantec will continue to release antivirus definitions and product updates compatible with Server 2003 for the current product cycle.
Depending on security demands and development, future versions of SEP may drop support for retired operating systems. As always, Symantec will provide explicit system requirements in the documentation for every product update we release.
As more substantial information on Symantec's support for Endpoint Protection on Windows Server 2003 develops, this article will be updated accordingly.
