Strengthening Domain Policy Settings

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2, Windows Server 2008, Windows Server 2008 R2

Domain security policy settings provide Active Directory with domain-wide security options for handling authentication and authorization of Active Directory security principals. These policy settings are implemented as security settings within the Default Domain Policy GPO. Domain policy is applied to all security principal accounts in the domain, unless inheritance is specifically blocked or overridden by another policy.

Security Policy settings are applied at the domain level by default for the following categories:

• Account Policies, which include:

  • Password Policy

  • Account Lockout Policy

  • Kerberos Policy

Modifying Domain Security Policy

You can make changes to Group Policy by modifying the default GPO or by creating a new GPO. The recommendation for making changes to domain security policy is to always modify the default GPO. The primary reason for this recommendation is that APIs that were developed for earlier versions of the operating system update policy settings in the Default Domain Policy GPO. For this reason, make all changes to domain security policy settings by editing this GPO.

To increase comprehensive security for your domain, apply the Password Policy, Account Lockout Policy, and Kerberos Policy settings that are recommended in this guide.

Password Policy

In Windows Server 2003, the most common means of authenticating a user’s identity is the use of secret user passwords. After a user has been identified and authenticated, the user can perform any tasks or access any resource for which the user’s account is authorized. Strong passwords generally enhance security for Active Directory users. Using strong passwords helps avoid the threat of an unauthorized user guessing (cracking) a weak password and acquiring the credentials of the compromised user account. This benefit applies especially to administrative accounts, because an unauthorized user could obtain administrative credentials and thereby gain elevated privileges.

A complex password that changes regularly reduces the likelihood of a successful spoofing attack. Password Policy settings control the complexity and lifetime for passwords. Table 13 includes the default and recommended Password Policy settings for a domain.

Table 13   Default and Recommended Password Policy Settings

Account Lockout Policy

More than a few unsuccessful password tries during the logon process can represent an attempt by an attacker to determine an account password by trial and error. Windows Server 2003 keeps track of logon attempts, and it can be configured to respond to this type of attack by disabling the account for a preset period of time. This response is referred to as account lockout.

Account Lockout Policy settings control the threshold for this response and the actions to be taken when the threshold is reached. Table 14 includes the default and recommended Account Lockout Policy settings.

Table 14   Default and Recommended Account Lockout Policy Settings

Kerberos Policy

In Windows Server 2003, Kerberos provides the default mechanism for authentication services, as well as the authorization data that is necessary for a user to access a resource and perform a task with that resource. If the lifetimes of Kerberos tickets are reduced, the risk of having a legitimate user’s credentials stolen and used by an attacker diminishes. However, authorization overhead increases. Table 15 includes the default Kerberos policy settings. No changes to these default settings are recommended.

Table 15  Default and Recommended Kerberos Policy Settings