Hardening the Windows infrastructure

Hardening the Microsoft Windows Server 2008 operating system reduces the attack surface by disabling functionality that is not required while maintaining the minimum functionality that is required. When you install Microsoft Forefront Threat Management Gateway as part of the installation of Essential Business Server, the setup program automatically hardens the Windows Server 2008 operating system running on the Forefront TMG computer after the installation of Forefront TMG is completed by launching the Scwcmd.exe command-line tool with the following command:

scwcmd.exe configure /p:isa_harden.xml

This command applies the security policy defined in the file Isa_harden.xml, which is supplied with Forefront TMG. When this security policy is applied, the startup type of numerous services is configured. 

The following table lists the services whose startup type is set by the security policy defined in Isa_harden.xml.

The security policy defined in the file Isa_harden.xml also configures your Forefront TMG computer as a client of other servers. The following client features are enabled:

• MSClient
• TimeSync
• DHCPClient
• DNSClient
• DynamicDNS

The remaining sections of this topic assume that you have applied the configurations recommended in the "Windows Server 2008 Security Guide" on the computer running Forefront TMG. Specifically, you should apply the Microsoft Baseline Security Policy security template. However, do not implement the IPsec filters or any of the server role policies.

In addition, you should consider Forefront TMG functionality and consider performing manual hardening of the operating system accordingly.

If you want to harden your server manually, you can configure the service startup mode, as described in this section. You configure the computer as does the Security Configuration Wizard.

For a server to perform necessary tasks, specific services must be enabled in accordance with the roles that you select. Unnecessary services should be disabled. The following table lists possible server tasks for Forefront TMG, describes when they may be required, and lists the services that should be activated when you perform each task.

• To function properly, time-synchronizing client applications require that either the Wireless or the Server service is running.
• To function properly, performance counters require that both the Remote Registry and Server services are running.
• The startup mode for the Server service should be Automatic when you use Routing and Remote Access Management, rather than Forefront TMG Management, to configure a virtual private network (VPN).
• The startup mode for the Routing and Remote Access service is manual. Forefront TMG starts the service only if a VPN is enabled.
• The Server service is required only if you use Routing and Remote Access Management (rather than Forefront TMG Management) to configure a VPN.

Servers can be clients of other servers. Client features are dependent on feature-specific services being enabled. The following table lists possible client features for Forefront TMG, describes when they may be required, and lists the services that should be activated when you enable the feature.

You can create a security template by using the Security Templates Microsoft Management Console (MMC) snap-in. A security template is an .inf file that includes information about which services should be enabled, as well as their startup mode, and can contain security settings that cannot be set with the Security Configuration Wizard. However, you can include a security template in a security policy created with the Security Configuration Wizard and then apply the security policy to your Forefront TMG computer.