Some high-security options can be implemented only by using the Registry Editor. The Registry Editor should be used only by administrators who are familiar with the material in Part IV, "Windows NT Registry," of the Windows NT Resource Guide.
There are several user rights that administrators of high-security installations should be aware of and possibly audit. Of these, you might want to change the default permissions on two rights, as follows:
User Right | Groups assigned this right by default | Recommended change |
Log on locally | Administrators, Backup Operators, Everyone, Guests, Power Users, and Users | Deny Everyone and Guests this right. |
Shut down the system (SeShutdownPrivilege) | Administrators, Backup Operators, Everyone, Power Users, and Users | Deny Everyone and Users this right. |
The rights in the following table generally require no changes to the default settings, even in the most highly secure installations.
|
| Initially |
Access this computer from the network | A user to connect over the network to the computer. | Administrators, Everyone, Power Users |
Act as part of the operating system (SeTcbPrivilege) | A process to perform as a secure, trusted part of the operating system. Some subsystems are granted this right. | (None) |
Add workstations to the domain (SeMachineAccountPrivilege) | Nothing. This right has no effect on computers running Windows NT. | (None) |
Back up files and directories (SeBackupPrivilege) | A user to back up files and directories. This right supersedes file and directory permissions. | Administrators, Backup Operators |
Bypass traverse checking (SeChangeNotifyPrivilege) | A user to change directories and access files and subdirectories even if the user has no permission to access parent directories. | Everyone |
Change the system time (SeSystemTimePrivilege) | A user to set the time for the internal clock of the computer. | Administrators, Power Users |
Create a pagefile (SeCreatePagefilePrivilege) | Nothing. This right has no effect in current versions of Windows NT. | Administrators |
Create permanent shared objects (SeCreatePermanentPrivilege) | A user to create special permanent objects, such as \\Device, that are used within Windows NT. | (None) |
Force shutdown from a remote system (SeRemoteShutdownPrivilege) | Nothing. This right has no effect in current versions of Windows NT. | Administrators, Power Users |
Increase quotas (SeIncreaseQuotaPrivilege) | Nothing. This right has no effect in current versions of Windows NT. | (None) |
Increase scheduling priority (SeIncreaseBasePriorityPrivilege) | A user to boost the execution priority of a process. | Administrators, Power Users |
Load and unload device drivers (SeLoadDriverPrivilege) | A user to install and remove device drivers. | Administrators |
Lock pages in memory (SeLockMemoryPrivilege) | A user to lock pages in memory so they cannot be paged out to a backing store such as PAGEFILE.SYS. | (None) |
Log on as a batch job | Nothing. This right has no effect in current versions of Windows NT. | (None) |
Log on as a service | A process to register with the system as a service. | (None) |
Manage auditing and security log (SeSecurityPrivilege) | A user to specify what types of resource access (such as file access) are to be audited, and to view and clear the security log. Note that this right does not allow a user to set system auditing policy using the Audit command in the Policy menu of User Manager. Also, members of the Administrators group always have the ability to view and clear the security log. | Administrators |
Modify firmware environment variables (SeSystemEnvironmentPrivilege) | A user to modify system environment variables stored in nonvolatile RAM on systems that support this type of configuration. | Administrators |
Profile single process (SeProfSingleProcess) | Nothing. This right has no effect on computers running Windows NT. | Administrators, Power Users |
Profile system performance (SeSystemProfilePrivilege) | A user to perform profiling (performance sampling) on the system. | Administrators |
Replace a process-level token (SeAssignPrimaryTokenPrivilege) | A user to modify a process's security access token. This is a powerful right used only by the system. | (None) |
Restore files and directories (SeRestorePrivilege) | A user to restore backed-up files and directories. This right supersedes file and directory permissions. | Administrators, Backup Operators |
Take ownership of files or other objects (SeTakeOwnershipPrivilege) | A user to take ownership of files, directories, printers, and other objects on the computer. This right supersedes permissions protecting objects. | Administrators |
Among the files and directories to be protected are those that comprise the operating system software itself. The standard set of permissions on system files and directories provide a reasonable degree of security without interfering with the computer's usability. For very high level security installations, however, you might want to set directory permissions to all subdirectories and existing files, as shown in the following list, immediately after Windows NT is installed. Be sure to apply permissions to parent directories before applying permissions to subdirectories.
Directory | Permissions |
\WINNT35 | Administrators: Full Control |
\WINNT35\REPAIR | Administrators: Full Control |
\WINNT35\SYSTEM | Administrators: Full Control |
\WINNT35\SYSTEM32 | Administrators: Full Control |
\WINNT35\SYSTEM32\CONFIG | Administrators: Full Control |
\WINNT35\SYSTEM32\DHCP | (Delete this directory) |
\WINNT35\SYSTEM32\DRIVERS | Administrators: Full Control |
\WINNT35\SYSTEM32\RAS | (Delete this directory) |
\WINNT35\SYSTEM32\OS2 | (Delete this directory) |
\WINNT35\SYSTEM32\SPOOL | Administrators: Full Control |
\WINNT35\SYSTEM32\WINS | (Delete this directory) |
Several critical operating system files exist in the root directory of the system partition on Intel 80486 and Pentium-based systems. In high-security installations you might want to assign the following permissions to these files:
File | C2-Level Permissions |
\BOOT.INI, \NTDETECT.COM, \NTLDR | Administrators: Full Control |
\AUTOEXEC.BAT, \CONFIG.SYS | Everybody: Read |
*
To view these files in File Manager, choose the By File Type command from the View menu, then select the Show Hidden/System Files check box in the By File Type dialog box.
In addition to the considerations for standard security, the administrator of a high-security installation might want to set protections on certain keys in the Registry.
By default, protections are set on the various components of the Registry that allow work to be done while providing standard level security. For high-level security, you might want to assign access rights to specific Registry keys. This should be done with caution, since programs that the users require to do their jobs often need to access certain keys on the users' behalf. For more information, see Chapter 11, "Registry Editor and Registry Administration," in the Windows NT Resource Guide.
In particular, you might want to change the protections of the following keys so that the group Everyone is only allowed QueryValue, Enumerate Subkeys, Notify, and Read Control accesses.
In the HKEY_LOCAL_MACHINE on Local Machine dialog:
\Software\Microsoft\RPC (and its subkeys)
\Software\Microsoft\Windows NT\CurrentVersion
And under the \Software\Microsoft\Windows NT\CurrentVersion\ subtree:
Profile List
AeDebug
Compatibility
Drivers
Embedding
Fonts
FontSubstitutes
GRE_Initialize
MCI
FontSubstitutes
GRE_Initialize
MCI
MCI Extensions
Port (and all subkeys)
WOW (and all subkeys)
Windows3.1MigrationStatus (and all subkeys)
In the HKEY_CLASSES_ROOT on Local Machine dialog:
\HKEY_CLASSES_ROOT (and all subkeys)
The Schedule service (also known as the AT command) is used to schedule tasks to run automatically at a preset time. Because the scheduled task is run in the context run by the Schedule service (typically the operating system's context), this service should not be used in a highly secure environment.
By default, only Administrators can submit AT commands. To allow System Operators to also submit AT commands, use the Registry Editor to create or assign the following Registry key value:
Hive | HKEY_LOCAL_MACHINE\System |
Key | \CurrentControlSet\Control\Lsa |
Name | Submit Control |
Type | REG_DWORD |
Value | 1 |
There is no way to allow anyone else to submit AT commands. The changes will take effect the next time the computer is started. You might want to update the Emergency Repair Disk to reflect these changes.
By default, Windows NT places the username of the last user to log on the computer in the Username text box of the logon dialog. This makes it more convenient for the most frequent user to log on. To help keep usernames secret, you can prevent Windows NT from displaying the username from the last logon. This is especially important if a computer that is generally accessible is being used for the (renamed) built-in Administrator account.
To prevent display of a username in the Logon dialog box, use the Registry Editor to create or assign the following Registry key value:
Hive | HKEY_LOCAL_MACHINE |
Key | SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon |
Name | DontDisplayLastUserName |
Type | REG_SZ |
Value | 1 |
Most personal computers today support the ability to start a number of different operating systems. For example, even if you normally start Windows NT from the C: drive, someone could select another version of Windows on another drive, including a floppy drive or CD-ROM drive. If this happens, any security precautions you have taken within your normal version of Windows NT might be circumvented.
In general, you should install only those operating systems that you want to be used on the computer you are setting up. For a highly secure system, this will probably mean installing one version of Windows NT. However, you still need to protect the CPU physically to ensure that no other operating system is loaded. Depending on your circumstances, you might choose to remove the floppy drive or drives. In some computers you can disable booting from the floppy drive by setting switches or jumpers inside the CPU. If you use hardware settings to disable booting from the floppy drive, you might want to lock the computer case (if that is an option with the computer you have) or lock the machine in a cabinet with a hole in the front to provide access to the floppy drive. If the CPU is in a locked area away from the keyboard and monitor, drives cannot be added or hardware settings changed for the purpose of starting from another operating system.
Normally, you can shut down a computer running Windows NT Workstation without logging on by choosing Shutdown in the Logon dialog box. This is appropriate where the computer's operational switches can be accessed by users; otherwise, they might tend to turn off the computer's power or reset it without properly shutting down Windows NT Workstation. However, you can remove this feature if the CPU is locked away so users cannot reset it or turn off its power. This step is not required for Windows NT Server, because it is configured this way by default.
To require users to log on before shutting down the computer, use the Registry Editor to create or assign the following Registry key value:
Hive | HKEY_LOCAL_MACHINE |
Key | SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon |
Name | ShutdownWithoutLogon |
Type | REG_SZ |
Value | 0 |
The changes will take effect the next time the computer is started. You might want to update the Emergency Repair Disk to reflect these changes.
By default, Windows NT allows any program to access files on floppy disks and CD-ROMs. In a highly secure, multi-user environment, you might want to allow only the person interactively logged on to access those devices. This allows the interactive user to write sensitive information to these drives, confident that no other user or program can see or modify that data.
When operating in this mode, the floppy disks and/or CD-ROMs on your system are allocated to a user as part of the interactive logon process. These devices are automatically freed for general use or for reallocation when that user logs out. Because of this, it is important to remove sensitive data from the floppy or CD-ROM drives before logging off.
Note
Windows NT allows all users access to the tape drive, and therefore any user can read and write the contents of any tape in the drive. In general this is not a concern, because only one user is interactively logged on at a time. However, in some rare instances, a program started by a user can continue running after the user logs off. When another user logs on and puts a tape in the tape drive, this program can secretly transfer sensitive data from the tape. If this is a concern, restart the computer before using the tape drive.
To allocate floppy drives during logon, use the Registry Editor to create or assign the following Registry key value:
Hive: | HKEY_LOCAL_MACHINE |
Key: | Software\Microsoft\WindowsNT\CurrentVersion\Winlogon |
Name: | AllocateFloppies |
Type: | REG_DWORD |
Value: | 1 |
If the value does not exist, or is set to any other value, then floppy devices will be available for shared use by all processes on the system.
This value will take effect at the next logon. If a user is already logged on when this value is set, it will have no effect for that logon session. The user must log off and log on again to cause the device(s) to be allocated.
To allocate CD-ROMs during logon
Use the Registry Editor to create or assign the following Registry key value:
Hive: | HKEY_LOCAL_MACHINE |
Key: | Software\Microsoft\WindowsNT\CurrentVersion\Winlogon |
Name: | AllocateCDRoms |
Type: | REG_DWORD |
Value: | 1 |
If the value does not exist, or is set to any other value, then CD-ROM devices will be available for shared use by all processes on the system.
This value will take effect at the next logon. If a user is already logged on when this value is set, it will have no effect for that logon session. The user must log off and log on again to cause the device(s) to be allocated.