Appendix F - Windows 2000 Security Configuration Templates for the Evaluated Configuration

Article
03/24/2009

G-1. Baseline Windows 2000 Server Security Configuration Template
G-2. Baseline Windows 2000 Professional Security Template
G-3. Baseline Windows 2000 Domain Security Policy Template
G-4. Baseline Windows 2000 Domain Controller Security Policy Template
G-5. High Security Windows 2000 Server Security Template
G-6. High Security Windows 2000 Professional Security Template
G-7. High Security Windows 2000 Domain Security Policy Template
G-8. High Security Windows 2000 Domain Controller Security Policy Template

G-1. Baseline Windows 2000 Server Security Configuration Template

; (c) Microsoft Corporation 1997-2000
;
; Security Configuration Template for Security Configuration Editor
;
; Template Name: CC_Baseline_W2K_Server.inf
; Template Version: 1.0
;
;This Security Configuration Template provides settings to support the
;Evaluated Configuration of Windows 2000 under the Common Criteria (CC) for
;Information Technology Security Evaluation.
;
; Revision History
; 0000 - Original September 17, 2002

[version]
signature="$CHICAGO$"
Revision=1

[System Access]
;--------------------------------------------------------------------------------
;Account Policies - Password Policy.
;--------------------------------------------------------------------------------
MinimumPasswordLength = 8
RequireLogonToChangePassword = 0
ClearTextPassword = 0

;--------------------------------------------------------------------------------
;Account Policies - Lockout Policy.
;--------------------------------------------------------------------------------
LockoutBadCount = 5
ResetLockoutCount = 30
LockoutDuration = -1

;Note: The following are not configured when No Account Lockout
;ResetLockoutCount = 30
;LockoutDuration = -1

;--------------------------------------------------------------------------------
;Account Policies - Kerberos Policy.
;--------------------------------------------------------------------------------
[Kerberos Policy]
TicketValidateClient = 1

[Registry Values]
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount=1,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateFloppies=1,1
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateCDRoms=1,1
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,0
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode=4,1
MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown=4,1
MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous=4,1

;=========================================================================
;EVALUATED CONFIGURATION REQUIRED SECURITY SETTINGS. The additional Registry
;Value Settings listed below are required in the Common Criteria Evaluated
;Configuration. These settings will not appear in the security policy interface.
;=========================================================================

;--------------------------------------------------------------------------------
;Disable DirectDraw. This edit disables DirectDraw in order to prevent direct
;access to the graphics hardware by the application.
;--------------------------------------------------------------------------------
MACHINE\System\CurrentControlSet\Control\GraphicsDrivers\DCI\Timeout=4,0
;--------------------------------------------------------------------------------
;Disable unnecessary services. These services do not appear in the Services
;interface.
;--------------------------------------------------------------------------------
MACHINE\System\CurrentControlSet\Services\audstub\Start=4,4
MACHINE\System\CurrentControlSet\Services\mnmdd\Start=4,4
MACHINE\System\CurrentControlSet\Services\NdisTapi\Start=4,4
MACHINE\System\CurrentControlSet\Services\NdisWan\Start=4,4
MACHINE\System\CurrentControlSet\Services\NDProxy\Start=4,4
MACHINE\System\CurrentControlSet\Services\ParVdm\Start=4,4
MACHINE\System\CurrentControlSet\Services\PptpMiniport\Start=4,4
MACHINE\System\CurrentControlSet\Services\Ptilink\Start=4,4
MACHINE\System\CurrentControlSet\Services\RasAcd\Start=4,4
MACHINE\System\CurrentControlSet\Services\Rasl2tp\Start=4,4
MACHINE\System\CurrentControlSet\Services\Raspti\Start=4,4
MACHINE\System\CurrentControlSet\Services\Wanarp\Start=4,4

;--------------------------------------------------------------------------------
;Remove OS/2 and POSIX subsystems. This edit deletes the OS/2 and POSIX default
;values.
;--------------------------------------------------------------------------------
MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems\Optional=7,""

;--------------------------------------------------------------------------------
;Protect kernel object attributes.
;--------------------------------------------------------------------------------
MACHINE\System\CurrentControlSet\Control\Session Manager\EnhancedSecurityLevel=4,1

;--------------------------------------------------------------------------------
;Restrict Nuss Session Access.
;--------------------------------------------------------------------------------
MACHINE\System\CurrentControlSet\Services\lanmanserver\parameters\RestrictNullSessAccess=4,1

;--------------------------------------------------------------------------------
;Restrict Nuss Session Access over named pipes. These edits delete the default
;values.
;--------------------------------------------------------------------------------
MACHINE\System\CurrentControlSet\Services\lanmanserver\parameters\NullSessionPipes=7,""
MACHINE\System\CurrentControlSet\Services\lanmanserver\parameters\NullSessionShares=7,""

;--------------------------------------------------------------------------------
;SP3 Edit. Generate an audit event when the audit log reaches a percent full
;threshold. This policy is set to generate an audit event when the security event
;log is 90 percent full. If this is not addequate for local use, the
;administrator may adjust the percentage value for this key according to local
;requirements.
;--------------------------------------------------------------------------------
MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\WarningLevel=4,90

;--------------------------------------------------------------------------------
;Event Log - Log Settings
;--------------------------------------------------------------------------------
;Audit Log Retention Period:
;0 = Overwrite Events As Needed
;1 = Overwrite Events As Specified by Retention Days Entry
;2 = Never Overwrite Events (Clear Log Manually)

;Note: There are no event log settings specified in the baseline policies.

;--------------------------------------------------------------------------------
;system Services - Disable Services not Included in Common Criteria Evaluated
;Configuration.
;--------------------------------------------------------------------------------
[Service General Setting]
TrkWks,4,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
seclogon,4,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
Schedule,4,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
ClipSrv,4,"D:(A;OICI;CCLCSWLORC;;;WD)(A;OICI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;OICI;CCLCSWLORC;;;PU)(A;OICI;CCLCSWRPLO;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
NetDDEdsdm,4,"D:(A;OICI;CCLCSWLORC;;;WD)(A;OICI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;OICI;CCLCSWLORC;;;PU)(A;OICI;CCLCSWRPLO;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
AppMgmt,4,"D:(A;OICI;CCLCSWLORC;;;WD)(A;OICI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;OICI;CCLCSWLORC;;;PU)(A;OICI;CCLCSWRPLO;;;IU)(A;OICI;CCLCSWRPLO;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
MSDTC,4,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;RP;;;WD)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
LicenseService,4,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
SMTPSVC,4,"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
TrkSvr,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;RPWPDTRC;;;SY)"
Fax,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
wuauserv,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
BITS,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;DCRPWPDTRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
cisvc,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
MSFTPSVC,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
IISADMIN,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
SharedAccess,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
mnmsrvc,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
NetDDE,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;IU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)"
SysmonLog,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
RSVP,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)"
RasAuto,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
RasMan,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)"
NtmsSvc,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
RemoteAccess,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
SCardSvr,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)"
SCardDrv,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
SNMP,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
SNMPTRAP,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
TapiSrv,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;IU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;BU)"
TlntSvr,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
UPS,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
TermService,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
UtilMan,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
MSIServer,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"
W3SVC,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)"

;--------------------------------------------------------------------------------
;Registry Key Permissions.
;--------------------------------------------------------------------------------
[Registry Keys]
"CLASSES_ROOT",0,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;CCDCLCSWRPSDRC;;;PU)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\SOFTWARE\Microsoft\OS/2 Subsystem for NT",0,"D:PAR(A;CI;KA;;;BA)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)"
"MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SYSTEM\CurrentControlSet\Services\EventLog",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers",2,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;CCDCLCSWRPSDRC;;;PU)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\Computername",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\Software\Microsoft\Windows NT\CurrentVersion",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SOFTWARE\Classes\.hlp",0,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;CCDCLCSWRPSDRC;;;PU)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\SOFTWARE\Classes\helpfile",0,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;CCDCLCSWRPSDRC;;;PU)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\Software\Classes",0,"D:AR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;CCDCLCSWRPSDRC;;;PU)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\Software",0,"D:PAR(A;CI;KA;;;BA)(A;CIIO;KA;;;CO)(A;CI;CCDCLCSWRPSDRC;;;PU)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"

;--------------------------------------------------------------------------------
;Edit default group memberships.
;--------------------------------------------------------------------------------
[Group Membership]
;--------------------------------------------------------------------------------
;Remove accounts from the Guests group. These settings will not appear in the
;security policy interface.
;--------------------------------------------------------------------------------
%SceInfGuests%__Members =

[Strings]
SceInfAdministrator = Administrator
SceInfAdmins = Administrators
SceInfAcountOp = Account Operators
SceInfAuthUsers = Authenticated Users
SceInfBackupOp = Backup Operators
SceInfDomainAdmins = Domain Admins
SceInfDomainGuests = Domain Guests
SceInfDomainUsers = Domain Users
SceInfEveryone = Everyone
SceInfGuests = Guests
SceInfGuest = Guest
SceInfPowerUsers = Power Users
SceInfPrintOp = Print Operators
SceInfReplicator = Replicator
SceInfServerOp = Server Operators
SceInfUsers = Users

[Profile Description]
Description=Evaluated Configuration minimum required security policy settings for Windows 2000 Servers.

G-2. Baseline Windows 2000 Professional Security Template

; (c) Microsoft Corporation 1997-2000
;
; Security Configuration Template for Security Configuration Editor
;
; Template Name: CC_Baseline_W2K_Professional.inf
; Template Version: 1.0
;
;This Security Configuration Template provides settings to support the
;Evaluated Configuration of Windows 2000 under the Common Criteria (CC) for
;Information Technology Security Evaluation.
;
; Revision History
; 0000 - Original September 17, 2002

[version]
signature="$CHICAGO$"
Revision=1

;Note: The following are not configured when No Account Lockout
;ResetLockoutCount = 30
;LockoutDuration = -1

MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,0
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode=4,1
MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown=4,1
MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous=4,1

;--------------------------------------------------------------------------------
;Disable unnecessary services. These services do not appear in the Services
;interface.
;--------------------------------------------------------------------------------
MACHINE\System\CurrentControlSet\Services\audstub\Start=4,4
MACHINE\System\CurrentControlSet\Services\mnmdd\Start=4,4
MACHINE\System\CurrentControlSet\Services\NdisTapi\Start=4,4
MACHINE\System\CurrentControlSet\Services\NdisWan\Start=4,4
MACHINE\System\CurrentControlSet\Services\NDProxy\Start=4,4
MACHINE\System\CurrentControlSet\Services\ParVdm\Start=4,4
MACHINE\System\CurrentControlSet\Services\PptpMiniport\Start=4,4
MACHINE\System\CurrentControlSet\Services\Ptilink\Start=4,4
MACHINE\System\CurrentControlSet\Services\RasAcd\Start=4,4
MACHINE\System\CurrentControlSet\Services\Rasl2tp\Start=4,4
MACHINE\System\CurrentControlSet\Services\Raspti\Start=4,4
MACHINE\System\CurrentControlSet\Services\Wanarp\Start=4,4

;--------------------------------------------------------------------------------
;Restrict Nuss Session Access over named pipes. This edit deletes the default
;values.
;--------------------------------------------------------------------------------
MACHINE\System\CurrentControlSet\Services\lanmanserver\parameters\NullSessionPipes=7,""
MACHINE\System\CurrentControlSet\Services\lanmanserver\parameters\NullSessionShares=7,""

;Note: There are no event log settings specified in the baseline policies.

[Profile Description]
Description=Evaluated Configuration minimum required security policy settings for Windows 2000 Professional computers.

G-3. Baseline Windows 2000 Domain Security Policy Template

; (c) Microsoft Corporation 1997-2000
;
; Security Configuration Template for Security Configuration Editor
;
; Template Name: CC_Baseline_W2K_Domain.inf
; Template Version: 1.0
;
;This Security Configuration Template provides settings to support the
;Evaluated Configuration of Windows 2000 under the Common Criteria (CC) for
;Information Technology Security Evaluation.
;
; Revision History
; 0000 - Original September 17, 2002

[Version]
signature="$CHICAGO$"
Revision=1

;Note: The following are not configured when No Account Lockout
;ResetLockoutCount = 30
;LockoutDuration = -1

;--------------------------------------------------------------------------------
;Local Policies - User Rights Assignment.
;--------------------------------------------------------------------------------
;Note: This policy enforces the default Administrator rights on certain
;privileges across the Domain so that they may not be changed.]

[Privilege Rights]
SeNetworkLogonRight = *S-1-5-32-544,*S-1-5-11,*S-1-5-32-551,*S-1-5-32-547,*S-1-5-32-545
SeInteractiveLogonRight = *S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-547,*S-1-5-32-545
SeShutdownPrivilege = *S-1-5-32-547,*S-1-5-32-551,*S-1-5-11,*S-1-5-32-544
SeIncreaseQuotaPrivilege = *S-1-5-32-544
SeIncreaseBasePriorityPrivilege = *S-1-5-32-544
SeLoadDriverPrivilege = *S-1-5-32-544
SeSecurityPrivilege = *S-1-5-32-544
SeSystemEnvironmentPrivilege = *S-1-5-32-544
SeSystemProfilePrivilege = *S-1-5-32-544
SeTakeOwnershipPrivilege = *S-1-5-32-544

;Note: There are no event log settings specified in the baseline policies.

;--------------------------------------------------------------------------------
;Edit default group memberships.
;--------------------------------------------------------------------------------
[Group Membership]
;--------------------------------------------------------------------------------
;Remove accounts from the Guests group. These settings will appear in the
;Restricted Groups Policy within the Domain Security Policy MMC.
;--------------------------------------------------------------------------------
%SceInfGuests%__Members =

[Profile Description]
Description=Evaluated Configuration minimum required security policy settings for Windows 2000 Domains.

G-4. Baseline Windows 2000 Domain Controller Security Policy Template

; (c) Microsoft Corporation 1997-2000
;
; Security Configuration Template for Security Configuration Editor
;
; Template Name: CC_Baseline_W2K_DC.inf
; Template Version: 1.0
;
;This Security Configuration Template provides settings to support the
;Evaluated Configuration of Windows 2000 under the Common Criteria (CC) for
;Information Technology Security Evaluation.
;
; Revision History
; 0000 - Original September 17, 2002

[version]
signature="$CHICAGO$"
Revision=1

[System Access]
RequireLogonToChangePassword = 0

;--------------------------------------------------------------------------------
;Local Policies - User Rights Assignment.
;--------------------------------------------------------------------------------
[Privilege Rights]
SeNetworkLogonRight = *S-1-5-32-544,*S-1-5-11
SeInteractiveLogonRight = *S-1-5-32-548,*S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-550,*S-1-5-32-549
SeMachineAccountPrivilege =
SeBackupPrivilege = *S-1-5-32-549,*S-1-5-32-551,*S-1-5-32-544
SeChangeNotifyPrivilege = *S-1-1-0,*S-1-5-11,*S-1-5-32-544
SeSystemtimePrivilege = *S-1-5-32-549,*S-1-5-32-544
SeCreatePagefilePrivilege = *S-1-5-32-544
SeDebugPrivilege = *S-1-5-32-544
SeEnableDelegationPrivilege = *S-1-5-32-544
SeRemoteShutdownPrivilege = *S-1-5-32-549,*S-1-5-32-544
SeIncreaseQuotaPrivilege = *S-1-5-32-544
SeIncreaseBasePriorityPrivilege = *S-1-5-32-544
SeLoadDriverPrivilege = *S-1-5-32-544
SeBatchLogonRight =
SeSecurityPrivilege = *S-1-5-32-544
SeSystemEnvironmentPrivilege = *S-1-5-32-544
SeProfileSingleProcessPrivilege = *S-1-5-32-544
SeSystemProfilePrivilege = *S-1-5-32-544
SeUndockPrivilege = *S-1-5-32-544
SeCreateTokenPrivilege =
SeCreatePermanentPrivilege =
SeDenyNetworkLogonRight =
SeDenyBatchLogonRight =
SeDenyServiceLogonRight =
SeDenyInteractiveLogonRight =
SeAuditPrivilege =
SeTcbPrivilege =
SeLockMemoryPrivilege =
SeServiceLogonRight =
SeAssignPrimaryTokenPrivilege =
SeRestorePrivilege = *S-1-5-32-549,*S-1-5-32-551,*S-1-5-32-544
SeShutdownPrivilege = *S-1-5-32-549,*S-1-5-32-550,*S-1-5-32-551,*S-1-5-32-544,*S-1-5-32-548
SeSyncAgentPrivilege =
SeTakeOwnershipPrivilege = *S-1-5-32-544

;--------------------------------------------------------------------------------
;Local Policies - Security Options.
;--------------------------------------------------------------------------------
;--------------------------------------------------------------------------------
;Registry Values.
;--------------------------------------------------------------------------------
; Registry value name in full path = Type, Value
; REG_SZ ( 1 )
; REG_EXPAND_SZ ( 2 ) // with environment variables to expand
; REG_BINARY ( 3 )
; REG_DWORD ( 4 )
; REG_MULTI_SZ ( 7 )
[Registry Values]
MACHINE\System\CurrentControlSet\Control\Lsa\SubmitControl=4,0
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1

;--------------------------------------------------------------------------------
;Registry Key Permissions. Cleans out Power Users references from the Domain
;Controller that were inserted by an Evaluated Configuration Domain Security
;Policy.
;--------------------------------------------------------------------------------
[Registry Keys]
"CLASSES_ROOT",0,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers",2,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\SOFTWARE\Classes\.hlp",0,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\SOFTWARE\Classes\helpfile",0,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\Software\Classes",0,"D:AR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\Software",0,"D:PAR(A;CI;KA;;;BA)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"

[Profile Description]
Description=Evaluated Configuration required security policy (delta) settings for Windows 2000 Domain Controllers.

G-5. High Security Windows 2000 Server Security Template

; (c) Microsoft Corporation 1997-2000
;
; Security Configuration Template for Security Configuration Editor
;
; Template Name: CC_HiSec_W2K_Server.inf
; Template Version: 1.0
;
;This Security Configuration Template provides settings to support the
;Evaluated Configuration of Windows 2000 under the Common Criteria (CC) for
;Information Technology Security Evaluation.
;
; Revision History
; 0000 - Original September 17, 2002

[version]
signature="$CHICAGO$"
Revision=1

[System Access]
;--------------------------------------------------------------------------------
;Account Policies - Password Policy.
;--------------------------------------------------------------------------------
MinimumPasswordAge = 2
MaximumPasswordAge = 42
MinimumPasswordLength = 8
PasswordComplexity = 1
PasswordHistorySize = 24
RequireLogonToChangePassword = 0
ClearTextPassword = 0

;--------------------------------------------------------------------------------
;EVALUATED CONFIGURATION RECOMMENDED SECURITY SETTINGS. Rename Administrator and
;Guest accounts. This policy setting actually appears in the Security Options
;category of the policy interface. To set this policy via this template,
;uncomment the pertinent lines below and set an appropriate name in place of the
;sample name shown. Otherwise, the policy may be edited using the appropriate
;Security Policy interface. Do not use the names shown below as they are only
;sample placeholders.
;--------------------------------------------------------------------------------
;NewAdministratorName = "NewAdminName"
;NewGuestName = "NewGuestName"

;Note: The following are not configured when No Account Lockout
;ResetLockoutCount = 30
;LockoutDuration = -1

;--------------------------------------------------------------------------------
;Local Policies - Audit Policy.
;--------------------------------------------------------------------------------
[Event Audit]
AuditSystemEvents = 1
AuditLogonEvents = 3
AuditObjectAccess = 3
AuditPrivilegeUse = 3
AuditPolicyChange = 1
AuditAccountManage = 3
AuditProcessTracking = 3
AuditDSAccess = 3
AuditAccountLogon = 3

[Privilege Rights]
SeNetworkLogonRight = *S-1-5-32-545,*S-1-5-32-547,*S-1-5-32-551,*S-1-5-11,*S-1-5-32-544
SeInteractiveLogonRight = *S-1-5-32-545,*S-1-5-32-547,*S-1-5-32-551,*S-1-5-32-544

;--------------------------------------------------------------------------------
;NOTICE: The warning baner title and message shown below are temporary
;placeholders. The warning banner title and message must be edited to comply
;with local organizational policies and legal requirements.
;--------------------------------------------------------------------------------
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText=1,This message is a placeholder! The local system administrator and security manager must define the appropriate login warning message, in accordance with local organizational policies, that will appear here when a user attempts to log in.
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption=1,Placeholder for warning banner title.

MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,0
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireStrongKey=4,0
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireSignOrSeal=4,0
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SealSecureChannel=4,1
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SignSecureChannel=4,1
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange=4,0
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword=4,0
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableForcedLogOff=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode=4,1
MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown=4,1
MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel=4,5
MACHINE\Software\Microsoft\Non-Driver Signing\Policy=3,1
MACHINE\Software\Microsoft\Driver Signing\Policy=3,1
;--------------------------------------------------------------------------------
;The following Registry value will shut down the system immediately if it is
;unable to log security audits. While it is a recommended setting, it should
;only be enabled where there is a strict audit management process in place for
;reviewing, archiving, and clearing the audit log on a regular basis.
;--------------------------------------------------------------------------------
;MACHINE\System\CurrentControlSet\Control\Lsa\CrashOnAuditFail=4,1

;--------------------------------------------------------------------------------
;The following Registry values for auditing access of global system objects and
;backup and restore privileges will generate a large amount of audit events.
;While they are recommended settings, they should only be enabled where there is
;a strict audit management process in place for reviewing, archiving, and
;clearing the audit log on a regular basis. The maximum log size should also be
;edited to support an increase in events being logged.
;--------------------------------------------------------------------------------
;MACHINE\System\CurrentControlSet\Control\Lsa\AuditBaseObjects=4,1
;MACHINE\System\CurrentControlSet\Control\Lsa\FullPrivilegeAuditing=3,1

;=========================================================================
;EVALUATED CONFIGURATION RECOMMENDED SECURITY SETTINGS. The additional Registry
;Value Settings listed below are recommended for added security in the Common
;Criteria Evaluated Configuration. These settings will not appear in the security
;policy interface.
;=========================================================================

;--------------------------------------------------------------------------------
;Harden the TCP/IP stack aginst denial of service attacks. The following Registry
;TCP/IP-related values help to increase the resistance of the TCP/IP Stack in
;Windows 2000 against denial of service network attacks.
;--------------------------------------------------------------------------------
MACHINE\System\CurrentControlSet\Services\Tcpip\parameters\DisableIPSourceRouting=4,2
MACHINE\System\CurrentControlSet\Services\Tcpip\parameters\EnableDeadGWDetect=4,0
MACHINE\System\CurrentControlSet\Services\Tcpip\parameters\EnableICMPRedirect=4,0
MACHINE\System\CurrentControlSet\Services\Tcpip\parameters\EnablePMTUDiscovery=4,0
MACHINE\System\CurrentControlSet\Services\Tcpip\parameters\EnableSecurityFilters=4,1
MACHINE\System\CurrentControlSet\Services\Tcpip\parameters\KeepAliveTime=4,300000
MACHINE\System\CurrentControlSet\Services\NetBT\parameters\NoNameReleaseOnDemand=4,1
MACHINE\System\CurrentControlSet\Services\Tcpip\parameters\PerformRouterDiscovery=4,0
MACHINE\System\CurrentControlSet\Services\Tcpip\parameters\SynAttackProtect=4,2
MACHINE\System\CurrentControlSet\Services\Tcpip\parameters\TcpMaxConnectResponseRetransmissions=4,2
MACHINE\System\CurrentControlSet\Services\Tcpip\parameters\TcpMaxConnectRetransmissions=4,3
MACHINE\System\CurrentControlSet\Services\Tcpip\parameters\TCPMaxPortsExhausted=4,5

;--------------------------------------------------------------------------------
;Make screensaver password protection immediate. Sets the value of this key
;entry to 0 in order to make password protection effective immediately.
;--------------------------------------------------------------------------------
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScreenSaverGracePeriod=1,0

;--------------------------------------------------------------------------------
;Disable LMHash creation. The LM hash is relatively weak compared to the NTLM
;hash and therefore prone to rapid brute force attack. For the Evaluated
;Configuration LM authentication is not required and can therefore be disabled
;to ensure greater security.The string "bar" is a dummy value name for creating
;the key "NoLMHash" automatically.
;--------------------------------------------------------------------------------
MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash\bar=4,0

;--------------------------------------------------------------------------------
;Disable autorun. Disables autorun capabilities on all drives.
;--------------------------------------------------------------------------------
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun=4,255

;--------------------------------------------------------------------------------
;Generate administrative alerts when audit log is full. Edit this key as
;necessary to specify an appropriate authorized administrative account(s) to
;receive the administrative alerts.
;--------------------------------------------------------------------------------
MACHINE\System\CurrentControlSet\Services\Alerter\Parameters\AlertNames=7,Administrators

[System Log]
RestrictGuestAccess = 1

[Security Log]
MaximumLogSize = 10240
AuditLogRetentionPeriod = 2
RestrictGuestAccess = 1

[Application Log]
RestrictGuestAccess = 1

;--------------------------------------------------------------------------------
;File and Folder Permissions.
;--------------------------------------------------------------------------------
[File Security]
"%SystemDrive%\config.sys",2,"D:PAR(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)"
"%SystemDrive%\autoexec.bat",2,"D:PAR(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)"
"%SystemDrive%\ntbootdd.sys",2,"D:PAR(A;;FA;;;BA)(A;;FA;;;SY)"
"%SystemDrive%\ntldr",2,"D:PAR(A;;FA;;;BA)(A;;FA;;;SY)"
"%SystemDrive%\ntdetect.com",2,"D:PAR(A;;FA;;;BA)(A;;FA;;;SY)"
"%SystemDrive%\boot.ini",2,"D:PAR(A;;FA;;;BA)(A;;FA;;;SY)"
"%SystemDrive%\Temp",2,"D:PAR(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;CI;0x100026;;;BU)"
"%SystemDrive%\MSDOS.SYS",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%SystemDrive%\IO.SYS",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%SystemDrive%\Documents and Settings\All Users\Documents\DrWatson",2,"D:PAR(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;CI;0x100026;;;BU)"
"%SystemDrive%\Documents and Settings\All Users",0,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%SystemDrive%\Documents and Settings\Administrator",2,"D:PAR(A;OICI;FA;;;LA)(A;OICI;FA;;;SY)"
"%SystemDrive%\Documents and Settings",0,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%SystemDrive%\Documents and Settings\All Users\Documents\DrWatson\drwtsn32.log",2,"D:PAR(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%SystemDrive%\",0,"D:PAR(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%SystemRoot%\$NtServicePackUninstall$",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)"
"%SystemRoot%\Debug",0,"D:PAR(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%Systemdirectory%\secedit.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)"
"%Systemdirectory%\rsh.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)"
"%Systemdirectory%\rexec.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)"
"%Systemdirectory%\regedt32.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)"
"%Systemroot%\regedit.exe",2,"D:PAR(A;;FA;;;BA)(A;;FA;;;SY)"
"%Systemdirectory%\rcp.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)"
"%Systemdirectory%\ntbackup.exe",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)"
"%SystemDirectory%\ias",2,"D:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)"
"%SystemDirectory%\dllcache",2,"D:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)(A;OICI;GA;;;CO)"
"%SystemDirectory%\config",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)"
"%SystemDirectory%\spool\printers",2,"D:PAR(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;CI;0x1000ae;;;BU)"
"%SystemDirectory%\repl\export",0,"D:PAR(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICIIO;FA;;;CO)(A;OICI;0x1300a9;;;RE)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%SystemDirectory%\repl\import",0,"D:PAR(A;OICI;FA;;;BA)(A;OICI;0x1301bf;;;RE)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%SystemDirectory%\repl",0,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%SystemDirectory%\Setup",0,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%SystemDirectory%\NTMSData",0,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)"
"%SystemDirectory%\GroupPolicy",0,"D:PAR(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;AU)(A;OICI;FA;;;SY)"
"%SystemDirectory%\DTCLog",0,"D:PAR(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%SystemDirectory%\appmgmt",0,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICI;0x1201a9;;;BU)"
"%SystemDirectory%",2,"D:PAR(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%SystemRoot%\Debug\UserMode",0,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OIIO;0x100006;;;BU)(A;;0x100023;;;BU)"
"%SystemRoot%\Temp",2,"D:PAR(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;CI;0x100026;;;BU)"
"%SystemRoot%\repair",2,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)"
"%SystemRoot%\Registration",0,"D:PAR(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICI;FR;;;BU)"
"%SystemRoot%",2,"D:PAR(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
"%ProgramFiles%",2,"D:PAR(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"

[Profile Description]
Description=Evaluated Configuration high security policy settings for Windows 2000 Servers.

G-6. High Security Windows 2000 Professional Security Template

; (c) Microsoft Corporation 1997-2000
;
; Security Configuration Template for Security Configuration Editor
;
; Template Name: CC_HiSec_W2K_Professional.inf
; Template Version: 1.0
;
;This Security Configuration Template provides settings to support the
;Evaluated Configuration of Windows 2000 under the Common Criteria (CC) for
;Information Technology Security Evaluation.
;
; Revision History
; 0000 - Original September 17, 2002

[version]
signature="$CHICAGO$"
Revision=1

[System Access]
;--------------------------------------------------------------------------------
;Account Policies - Password Policy.
;--------------------------------------------------------------------------------
MinimumPasswordAge = 2
MaximumPasswordAge = 42
MinimumPasswordLength = 8
PasswordComplexity = 1
PasswordHistorySize = 24
RequireLogonToChangePassword = 0
ClearTextPassword = 0

;Note: The following are not configured when No Account Lockout
;ResetLockoutCount = 30
;LockoutDuration = -1

[Registry Values]
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption=1,1
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount=1,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateFloppies=1,1
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateDASD=1,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateCDRoms=1,1
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=4,0
;--------------------------------------------------------------------------------
;The following Registry value requires a user to log on to the WIndows 2000
;Professional computer before allowing a shutdown. It is the default on servers.
;--------------------------------------------------------------------------------
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon=4,0

MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,0
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireStrongKey=4,0
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireSignOrSeal=4,0
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SealSecureChannel=4,1
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SignSecureChannel=4,1
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange=4,0
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword=4,0
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableForcedLogOff=4,1
MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode=4,1
MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown=4,1
MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel=4,5
MACHINE\Software\Microsoft\Non-Driver Signing\Policy=3,1
MACHINE\Software\Microsoft\Driver Signing\Policy=3,1
;--------------------------------------------------------------------------------
;The following Registry value will shut down the system immediately if it is
;unable to log security audits. While it is a recommended setting, it should
;only be enabled where there is a strict audit management process in place for
;reviewing, archiving, and clearing the audit log on a regular basis.
;--------------------------------------------------------------------------------
;MACHINE\System\CurrentControlSet\Control\Lsa\CrashOnAuditFail=4,1

[System Log]
RestrictGuestAccess = 1

[Security Log]
MaximumLogSize = 10240
AuditLogRetentionPeriod = 2
RestrictGuestAccess = 1

[Application Log]
RestrictGuestAccess = 1

[Profile Description]
Description=Evaluated Configuration high security policy settings for Windows 2000 Professional computers.

G-7. High Security Windows 2000 Domain Security Policy Template

; (c) Microsoft Corporation 1997-2000
;
; Security Configuration Template for Security Configuration Editor
;
; Template Name: CC_HiSec_W2K_Domain.inf
; Template Version: 1.0
;
;This Security Configuration Template provides settings to support the
;Evaluated Configuration of Windows 2000 under the Common Criteria (CC) for
;Information Technology Security Evaluation.
;
; Revision History
; 0000 - Original September 17, 2002

[Version]
signature="$CHICAGO$"
Revision=1

[System Access]
;--------------------------------------------------------------------------------
;Account Policies - Password Policy.
;--------------------------------------------------------------------------------
MinimumPasswordAge = 2
MaximumPasswordAge = 42
MinimumPasswordLength = 8
PasswordComplexity = 1
PasswordHistorySize = 24
RequireLogonToChangePassword = 0
ClearTextPassword = 0

;Note: The following are not configured when No Account Lockout
;ResetLockoutCount = 30
;LockoutDuration = -1

;--------------------------------------------------------------------------------
;Local Policies - User Rights Assignment.
;--------------------------------------------------------------------------------
;Note: This policy enforces the default Administrator rights on certain
;privileges across the Domain so that they may not be changed.

[Registry Values]
MACHINE\Software\Microsoft\Driver Signing\Policy=3,1
MACHINE\Software\Microsoft\Non-Driver Signing\Policy=3,1
;--------------------------------------------------------------------------------
;The following Registry value will shut down the system immediately if it is
;unable to log security audits. While it is a recommended setting, it should
;only be enabled where there is a strict audit management process in place for
;reviewing, archiving, and clearing the audit log on a regular basis.
;--------------------------------------------------------------------------------
;MACHINE\System\CurrentControlSet\Control\Lsa\CrashOnAuditFail=4,1

MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel=4,5
MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous=4,1
MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4,1
MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown=4,1
MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableForcedLogOff=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword=4,0
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange=4,0
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SignSecureChannel=4,1
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SealSecureChannel=4,1
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireSignOrSeal=4,0
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireStrongKey=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName=4,1
;--------------------------------------------------------------------------------
;NOTICE: The warning baner title and message shown below are temporary
;placeholders. The warning banner title and message must be edited to comply
;with local organizational policies and legal requirements.
;--------------------------------------------------------------------------------
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption=1,Placeholder for warning banner title.
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText=1,This message is a placeholder! The local system administrator and security manager must define the appropriate login warning message, in accordance with local organizational policies, that will appear here when a user attempts to log in.

;--------------------------------------------------------------------------------
;The following Registry value requires a Domain user to log on to the computer
;before allowing a shutdown. It is the default on servers.
;--------------------------------------------------------------------------------
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon=4,0

MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateCDRoms=1,1
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateDASD=1,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateFloppies=1,1
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount=1,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption=1,1

[System Log]
RestrictGuestAccess = 1

[Security Log]
MaximumLogSize = 10240
AuditLogRetentionPeriod = 2
RestrictGuestAccess = 1

[Application Log]
RestrictGuestAccess = 1

[Profile Description]
Description=Evaluated Configuration high security policy settings for Windows 2000 Domains.

G-8. High Security Windows 2000 Domain Controller Security Policy Template

; (c) Microsoft Corporation 1997-2000
;
; Security Configuration Template for Security Configuration Editor
;
; Template Name: CC_HiSec_W2K_DC.inf
; Template Version: 1.0
;
;This Security Configuration Template provides settings to support the
;Evaluated Configuration of Windows 2000 under the Common Criteria (CC) for
;Information Technology Security Evaluation.
;
; Revision History
; 0000 - Original September 17, 2002
[version]
signature="$CHICAGO$"
Revision=1

[System Access]
RequireLogonToChangePassword = 0
ForceLogoffWhenHourExpire = 1

;--------------------------------------------------------------------------------
;Local Policies - User Rights Assignment.
;--------------------------------------------------------------------------------
[Privilege Rights]
SeNetworkLogonRight = *S-1-5-32-544,*S-1-5-11
SeInteractiveLogonRight = *S-1-5-32-548,*S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-550,*S-1-5-32-549
SeMachineAccountPrivilege =
SeBackupPrivilege = *S-1-5-32-549,*S-1-5-32-551,*S-1-5-32-544
SeChangeNotifyPrivilege = *S-1-1-0,*S-1-5-11,*S-1-5-32-544
SeSystemtimePrivilege = *S-1-5-32-549,*S-1-5-32-544
SeCreatePagefilePrivilege = *S-1-5-32-544
SeDebugPrivilege = *S-1-5-32-544
SeEnableDelegationPrivilege = *S-1-5-32-544
SeRemoteShutdownPrivilege = *S-1-5-32-549,*S-1-5-32-544
SeIncreaseQuotaPrivilege = *S-1-5-32-544
SeIncreaseBasePriorityPrivilege = *S-1-5-32-544
SeLoadDriverPrivilege = *S-1-5-32-544
SeBatchLogonRight =
SeSecurityPrivilege = *S-1-5-32-544
SeSystemEnvironmentPrivilege = *S-1-5-32-544
SeProfileSingleProcessPrivilege = *S-1-5-32-544
SeSystemProfilePrivilege = *S-1-5-32-544
SeUndockPrivilege = *S-1-5-32-544
SeCreateTokenPrivilege =
SeCreatePermanentPrivilege =
SeDenyNetworkLogonRight =
SeDenyBatchLogonRight =
SeDenyServiceLogonRight =
SeDenyInteractiveLogonRight =
SeAuditPrivilege =
SeTcbPrivilege =
SeLockMemoryPrivilege =
SeServiceLogonRight =
SeAssignPrimaryTokenPrivilege =
SeRestorePrivilege = *S-1-5-32-549,*S-1-5-32-551,*S-1-5-32-544
SeShutdownPrivilege = *S-1-5-32-549,*S-1-5-32-550,*S-1-5-32-551,*S-1-5-32-544,*S-1-5-32-548
SeSyncAgentPrivilege =
SeTakeOwnershipPrivilege = *S-1-5-32-544

;--------------------------------------------------------------------------------
;Local Policies - Security Options.
;--------------------------------------------------------------------------------
;--------------------------------------------------------------------------------
;Registry Values.
;--------------------------------------------------------------------------------
; Registry value name in full path = Type, Value
; REG_SZ ( 1 )
; REG_EXPAND_SZ ( 2 ) // with environment variables to expand
; REG_BINARY ( 3 )
; REG_DWORD ( 4 )
; REG_MULTI_SZ ( 7 )
[Registry Values]
MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LdapServerIntegrity=4,2
MACHINE\System\CurrentControlSet\Control\Lsa\SubmitControl=4,0
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature=4,0

;--------------------------------------------------------------------------------
;Registry Key Permissions. Cleans out Power Users references from the Domain
;Controller that are inserted by an Evaluated Configuration Domain Security
;Policy.
;--------------------------------------------------------------------------------
[Registry Keys]
"CLASSES_ROOT",0,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers",2,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\SOFTWARE\Classes\.hlp",0,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\SOFTWARE\Classes\helpfile",0,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\Software\Classes",0,"D:AR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\Software",0,"D:PAR(A;CI;KA;;;BA)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"

[Profile Description]
Description=Evaluated Configuration high security policy (delta) settings for Windows 2000 Domain Controllers.

Appendix F - Windows 2000 Security Configuration Templates for the Evaluated Configuration

On This Page

G-1. Baseline Windows 2000 Server Security Configuration Template

G-2. Baseline Windows 2000 Professional Security Template

G-3. Baseline Windows 2000 Domain Security Policy Template

G-4. Baseline Windows 2000 Domain Controller Security Policy Template

G-5. High Security Windows 2000 Server Security Template

G-6. High Security Windows 2000 Professional Security Template

G-7. High Security Windows 2000 Domain Security Policy Template

G-8. High Security Windows 2000 Domain Controller Security Policy Template

Additional resources