Customize security templates to roll out security policies
One of the greatest challenges you face is ensuring that each machine on your network conforms to a standard security policy. Since Windows NT 4.0 Service Pack 4 (SP4) came out, Microsoft has provided security templates and tools that you can use to accomplish this task. With Windows 2000, these templates and the tools to support them have matured and grown in functionality. Surprisingly, however, some administrators haven't heard of them, and many more administrators don't realize these tools' full potential.
This month, I show you how to use Win2K Microsoft Management Console (MMC) snap-ins to create, customize, and save security templates. I also show you how to use snap-ins to roll out and maintain template-based security policies.
Security Templates
A security template file is a text file that contains settings for various aspects of security, such as account and local policies, the event log, groups, system services, registry settings, and file-system permissions. By default, Windows stores these files with an .inf extension in the \%systemroot%\security\templates folder.
Microsoft supplies several security template files with the OS. The Microsoft Windows 2000 Server Resource Kit includes two further templates (you can find these templates in the resource kit installation directory), and you can download a custom security template to help you harden Win2K-based Web servers from the Microsoft Internet Information Services (IIS) 5.0 security checklist (http://www.microsoft.com/technet/prodtechnol/iis/tips/iis5chk.asp). Additional template files are created during the installation process and during promotion of a server to a domain controller (DC). Table 1, page 2, lists some notable templates. To open a template file and view its contents, double-click it or right-click the filename and select Open. However, be careful not to select the Install option, or you'll apply the settings in the template to your local system, which can be disastrous (especially on a DC).
Microsoft provides three basic security templates for workstation, server, and DC systems. These templates contain the baseline security configurations that should have been implemented when you performed a default fresh installation. If you upgraded an earlier Windows system to Win2K, the security settings won't match those in the basic templates. You must apply the appropriate template to your system by right-clicking the template and selecting Install or by using the MMC Security Configuration and Analysis snap-in, which I describe later.
The basic templates primarily define default registry and file-system permissions. If you're using FAT instead of NTFS partitions, you can't secure your system to the level that a basic template defines. If the basic templates don't provide sufficient security for your environment, consider using the secure and highly secure templates for workstation and DC systems. A secure template provides incrementally stricter security settings than a basic template, defining password policies, auditable events, and security options. A highly secure template provides incrementally stricter settings than a secure template; it expands the list of auditable events and tightens the security options. You must use the basic, secure, and highly secure templates in that order when auditing or configuring system security. (The Microsoft article "Windows 2000 Security Templates Are Incremental" at http://support.microsoft.com/support/kb/articles/q234/9/26.asp discusses this restriction in more detail.) As I show you later, you can create one template that incorporates these layered templates. However, you'll probably need to tailor these templates for your local requirements, and you should never apply a template without first looking to see what it contains and considering the implications for your systems and networks.
The MMC Security Templates Snap-in
The preferred method for viewing and modifying security templates is through the MMC Security Templates snap-in. By default, this snap-in doesn't appear under Start, Programs, Administrative Tools: You need to open MMC and add the snap-in to the console. To add the Security Templates snap-in, follow these steps:
- Click Start, Run. Type mmc, then click OK to open an empty console.
- Click the Console menu, then choose Add/Remove Snap-in.
- Click Add to display a dialog box that contains the list of available snap-ins, as Figure 1 shows.
- Scroll down the list to Security Templates, then click Add. Click Close.
- Click OK in the Add/Remove Snap-in dialog box.