Threats and Countermeasures Guide: Security Settings in Windows Server 2008 and Windows Vista

Applies To: Windows Server 2008

This guide is a reference to security settings that provide countermeasures for specific threats against current versions of the Windows® operating systems.

This guide is a companion for two other publications that are available from Microsoft:

• Windows Server® 2008 Security Guide (https://go.microsoft.com/fwlink/?LinkID=105788)

• Windows Vista® Security Guide (https://go.microsoft.com/fwlink/?LinkId=74027)

Many of the countermeasures that are described in this guide are not intended for specific computer roles in the companion guides, or in some cases for any roles at all. These countermeasures help ensure compatibility, usability, manageability, availability, or performance.

Generally, as security increases, functionality decreases, and vice versa. However, there are exceptions, and some security countermeasures actually help to improve functionality.

Each section begins with a brief explanation of what is in the section, followed by a list of subsection headings, each of which corresponds to a setting or group of settings. Each subsection includes a brief explanation of what the countermeasure does and the following three additional subsections:

• Vulnerability. Explains how an attacker might exploit a feature or its configuration.

• Countermeasure. Explains how to implement the countermeasure.

• Potential impact. Explains the possible negative consequences of countermeasure implementation.

For example, the section "Domain Level Account Policies" begins with the following subsections:

Account Policies

• Enforce password history

  • Vulnerability

  • Countermeasure

  • Potential impact

• Maximum password age

  • Vulnerability

  • Countermeasure

  • Potential impact

This pattern is repeated throughout this guide. Settings that are closely related are presented in a single subsection. For example, in the "Security Options" section, four related settings are all placed into the same subsection as follows:

Microsoft network client and server: Digitally sign communications

• Microsoft Network Client: Digitally Sign Communications (Always)

• Microsoft Network Server: Digitally Sign Communications (Always)

• Microsoft Network Client: Digitally Sign Communications (If Server Agrees)

• Microsoft Network Server: Digitally Sign Communications (If Client Agrees)

This guide focuses on those Group Policy settings that are considered security settings; those that are intended to help organizations manage their environments are not documented. This guide examines only the settings and features in Windows Server 2008 and Windows Vista that can help organizations secure their enterprises against specific threats. Settings and features that were added in service packs after the release of Windows Vista and Windows Server 2008, or functionalities that may have been added by software released after those service packs, may not be discussed in this guide. Also, management features and those security features that are not configurable by administrators are not described in this guide.

The information that is provided within this guide should help you and members of your organization understand the countermeasures that are available in current versions of the Windows operating system. For prescriptive guidance about what settings to use for specific scenarios, refer to the two companion guides:

• Windows Server 2008 Security Guide (https://go.microsoft.com/fwlink/?LinkId=105788)

• Windows Vista Security Guide (https://go.microsoft.com/fwlink/?LinkId=74027)

Section Overviews

This guide consists of seven sections that provide a reference to the settings that you should consider while planning the security policy for your organization.