windowsnt4.0+iis4.0 Security Configuration Guide (Turn)

In order to make the days of our programmers better, in order to make our high Xuan heart can be put down, hope to help everyone.
Install WindowsNT
To effectively build a secure WindowsNT server, you must start with the installation. If the file allocation table (FAT) is already installed
WindowsNT, recommended for reinstallation.
1. Install a clean system, the system should be installed and configured with the public network disconnect, if you need to connect to the network, you need to ensure that the network is an isolated can
network segment of trust;
2. It is recommended that you install Windows NT4.00 us-english (reason: 1). USA restrictions on PRC export encryption products, e.g. only allow IE to be exported (40bitRAS SSL)
To PRC. 2.MicroSoft discrimination against PRC users. 3.Microsft products are generally only strictly tested in Chinese version. 4. Two-byte character encoding special
Of
(When using ASP in the nt4.0+sp4+iis4.0 version, use the http://www.xxx.org/test/ok.asp%
81 you can see the original code of ok.asp, the reason is that IIS can not properly handle the%81 character. No
Install other operating systems to prevent others from modifying your NT system from other systems. Use only the NTFS file system;
3. Select a standalone member server (stand-alone) when installing NT Server; The server cannot join the domain environment; IIS2.0 If you want to install
IIS, which can be installed from the Option Pack (NT Option pack).
4. In network protocols and services, only TCP/IP is installed and no additional network services are installed.
Install additional software
Server is dedicated to do services, do not have any software installed, because the third party software generated a lot of loopholes, choose a few must install on it!
1. Install third party software (e.g. IIS4.0)
2. Install the last service pack. (is currently SP6)
3. Install the Hot fix Pack (hotfixes) that you can use FTP://FTP.MICROSOFT.COM/BUSSYS/WINNT/WINNTPUBLIC/FIXES/USA/NT40
Remove Unused network services
Redundant network services can sometimes create security problems.
Open network control in the dashboard, remove all network services, only RPC Configuration (rpcss:for Port Mapper), which is required by IIS
Works
After removing the Workstation service (Workstation service), each time the network application is started, a message box pops up: "Windows NT
Networking is not installed.do your want to
Install it now?, select "No". Another problem is that Usrmgr.exe cannot work, and can be replaced by a workstation version of Musrmgr.exe.
Disable NETBIOS
Do not listen for NetBIOS ports, all network adapters do not bind wins Client
Network->bindings->all protocola->wins client->disable.
Disable WINS Client Driver