Practice: Analyzing Administrative Template Settings To Control Application Features

By Author: unknownmem
Total Articles: 128
Comment this article

Spend time learning about each selection in the Terminal 70-680 exam(http://www.70-680.com)
Services section of the administrative templates in Group Policy. Use the Explain tabs and any additional resources that you need, such as the results from searching the Technet Web site or the Windows XP Security Guide. Then use Table 11-5 to record at least five rec?ommendations for hardening terminal services (making sure they are things that can be done with Group Policy), and provide your reasons for making these recommendations. You cannot use any recommendations that were already used in this lesson.
Recommendations for Hardening Terminal Services—Answer Key
Enable this setting to prevent users with Citrix ICA clients from reconnecting to a session from a computer other than the computer that they started the session with. This might prevent a hijacked session, one where the original user does not end a session before logging off, and another user, who has obtained the original user's credentials, reconnects to the session. Unfortunately, this setting works only when Citrix clients are used.
Enable ...
... and set a time limit. If a Windows 7 certificate(http://www.mcitp-70-680.com)
user leaves her desktop unattended after starting a session, this timeout will disconnect the session after the specified time. This can prevent someone from simply using the session at the user's desktop while the user is away. The interloper would have access to anything that the original user would because the interloper is using her credentials.
Enable this setting to restrict a user's activity on the terminal server. The Start button is not displayed, and when the user ends the des?ignated program, the session is automatically terminated.
Enable this setting to prevent any viewing or remote control of a session. If an administrator can view a session, he can view sensitive information. If he can remotely control it, he can act as the user. Neither of these capabilities is desirable where users do confidential or sensitive work.
Enable this setting to prevent an administrator from forcing the logoff of another administrator when the first administrator is connected to the console. If the first comptia security+( http://www.securityplus-sy0-201.com)
administrator is forced off the session, all data not saved is lost. This might not be a good idea.