Practice: Administering The Security Log

By Author: Mike Jones
Total Articles: 256
Comment this article

Hisecws.inf To apply Hisecws.inf to a computer, the following mcitp boot camp requirements must be met:
All of the domain controllers that contain the accounts of all users that will log on to the client must run Windows NT 4 Service Pack 4 or later.
All of the domain controllers for the domain that the client is joined to must run Microsoft Windows 2000 or later.
If a client is configured with Hisecws.inf, the following constraints apply:Clients cannot connect to computers that only run LAN Manager or computers
running Windows NT 4 Service Pack 3 or earlier using a local account on the target server.
Clients cannot connect to servers running Windows 2000 or Windows NT 4 Service Pack 4 using a local account defined on the target server unless the clock on
the target server is within 30 minutes of the clock on the client.
Clients cannot connect to computers running Windows XP or later using a local account defined on the target computer unless the clock on the target computer is within 20 hours of the clock on the client.
Clients cannot connect ...
... to LAN Manager servers operating in windows 7 enterprise desktop support technician share-level security mode.
If a server is configured with Hisecws.inf, the following constraints apply:
A user with a local account on that server cannot connect to the server from a client that does not support NTLM version 2.
A client with a local account on that server cannot connect to the server unless the client computer is configured to send NTLM version 2 responses.
All clients that want to use SMB to connect to that server must enable client-side 8MB packet signing. All computers running Windows 2000 or later enable client-side SMB packet signing by default.
Hisecws.inf uses Restricted Groups settings to remove all members of the Power Users group and ensure that only Domain Admins and the local Administrator account are members of the local Administrators group. Hisecws.inf defines these group restrictions under the assumption that only applications that take part in the Windows Logo Program for Software are deployed. With certified applications in place, neither the insecure Compatible template nor the insecure Power Users group is needed. Instead, users can run certified applications successfully under the secure context of a normal
MCITP certification user as defined by the default security settings of the file system and registry.