Windows System Security Settings-Advanced Security

 

1. Disable DirectDraw

This is the requirement of C2 security standards for video cards and memory. Disabling DirectDraw may affect some programs that require DirectX (such as games, playing Starcraft on servers? I'm dizzy ..$%$^ % ^ &??), However, the vast majority of commercial sites should be unaffected. Modify the Timeout (REG_DWORD) of the HKLMSYSTEMCurrentControlSetControlGraphicsDriversDCI registry to 0.

2. Disable default share

After win2000 is installed, the system will create some hidden shares. You can click net share under cmd to view them. There are many articles about IPC intrusion on the Internet. I believe you will be familiar with it. To disable sharing, choose Administrative Tools> Computer Management> shared folders> share, right-click the shared folder, and click stop sharing. However, after the machine restarts, these shares will be re-enabled.

Default shared directory path and Function

C$D$E$The root directory of each partition. In Win2000 Pro, Only Administrator

And members of the Backup Operators group.

The Server Operatros group can also be connected to these shared directories.

ADMIN$% SYSTEMROOT % shared directory for remote management. Its path will always be

Point to the Win2000 installation path, such as c: winnt

FAX$In Win2000 Server, FAX$The fax will be sent to the fax client.

IPC$Empty connection. IPC$Sharing provides the ability to log on to the system.

NetLogon: the Net Login service shared on the Windows 2000 Server

Used for login domain requests

PRINT$% SYSTEMROOT % SYSTEM32SPOOLDRIVERS user remote printer Management

Solution:

Open Registry Editor. REGEDIT

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceslanmanserverparameters

Create a DWORD key named AutoShareServer on the right. The value is 0.

3. Disable dump file generation

Dump files are useful in searching for problems when the system crashes and the blue screen (or I will translate them into junk files literally ). However, it can also provide some sensitive information to hackers, such as the passwords of some applications. To disable it, Open Control Panel> System Properties> advanced> Start and fault recovery and change the write debugging information to none. You can open it again.

4. Use the file encryption system EFS

The powerful encryption system of Windows2000 can provide security protection for disks, folders, and files. This prevents others from attaching your hard disk to another machine to read the data. Remember to use EFS for folders, not just a single file. For more information about EFS, see

Asp ">Http://www.microsoft.com/windows2000/techi...ity/encrypt.asp

5. encrypt the temp folder

Some applications will copy some items to the temp folder during installation and upgrade, but they will not clear the contents of the temp folder when the program is upgraded or disabled. Therefore, encryption to the temp folder provides multiple protection for your files.

6. Lock the Registry

In windows2000, Only administrators and Backup Operators have the permission to access the registry from the network. If you think it is not enough, you can further set the Registry access permission.

7. Clear page files when shutting down

The page file, that is, the scheduling file, is a hidden file used by win2000 to store programs and data files that are not loaded into the memory. Some third-party programs can store unencrypted passwords in the memory, and the page files may contain other sensitive information. To clear the page file when shutting down, edit the Registry

HKLMSYSTEMCurrentControlSetControlSession ManagerMemory Management

Set ClearPageFileAtShutdown to 1.

8. Do not start the system from a floppy disk or CD Rom.

Some third-party tools can bypass the original security mechanism by guiding the system. If your server has high security requirements, consider using removable floppy disks and optical drives. It is a good method to lock the machine box.

9. Consider using a smart card instead of a password

The password is always a dilemma for the security administrator and is vulnerable to attacks by tools such as 10 phtcrack. If the password is too complex, the user will write the password everywhere in order to remember the password. If conditions permit, it is a good solution to replace complex passwords with smart cards.

10. Consider using IPSec

As the name implies, IPSec provides the security of IP packets. IPSec provides authentication, integrity, and optional confidentiality. The sender's computer encrypts the data before transmission, and the receiver's computer decrypts the data after receiving the data. IPSec can greatly enhance the security performance of the system.