Securing
Microsoft Windows XP Professional
By
Zeb Bowden and Marc DeBonis
Version
1.3 - 062404
Background
Windows XP is the newest
desktop class operating system from Microsoft Corporation. Multiple versions of the XP operating system
exist, however this document assumes you are using XP Professional; some of the
suggestions in this paper may not be applicable in other XP versions. The core
architecture of Windows XP is built on the proven, stable code base of Windows
2000/NT. The user interface has been revamped in XP, giving users a more 3-D
experience along with other “eye candy” such as fading and new icons. On the
security front, Windows XP provides some built-in features to help protect against
common threats such as worms and viruses. One of the most important security
related features of Windows XP is that it has a built-in firewall installed.
The Windows XP operating system is designed to be more secure “out of the box”.
More secure is of course a relative term and while XP does to a better job of
locking down the workstation by default, it is no where close to being
completely secure. This document is provided to help you tighten the security
of your XP system, while maintaining system usability.
Why should you care about computer security?
Computer security should be
the concern of every person who owns or operates a computer. If you’re not big on ethics, or aren’t
convinced, you may wish to review this link:
In particular, line two of
the document states in part:
“…You are responsible for all
activities on your userid or that originate from your system…”
This clause negates the
argument “There is nothing on my computer anybody would want.” If not for the data on your system they can
and will use your system to break into other people’s systems. When the trail winds its way back, somebody
will come knocking on your door. Don’t
be surprised that the FBI doesn’t shed a tear when you tell them that the only
copy of your term paper is on your computer and they tag-and-bag every piece of
electronic equipment in your dorm room.
Strong stuff, but it happens every day.
Don’t forget the social implications of your system becoming
compromised. How long will your friends
continue to read messages you send when your system spews out infected email,
day after day? Or, when the assignment
you turn into the professor infects his/her system with a nasty virus? Worked hard on that paper or your mp3
collection? Too bad that trojan you just
ran from somebody you don’t even know is deleting every single file on your
machine. Avoid all of that terrible stuff by following this guide.
Assumptions
Enable the Built-in Internet Connection
Firewall (ICF)
Firewalls are used to
provide a “protective” boundary between your computer and the Internet. Windows
XP Professional conveniently has a firewall built-in called Internet Connection
Firewall (ICF). Do not allow the term “firewall” to lull you into a false sense
of security. Firewalls are not the ultimate solution to every security problem;
rather they provide an additional layer of protection for your system.
1.
Log in as an Administrator
2.
Go to Start->Control Panel
3.
Click on “Network and Internet Connections”
4.
Click “Network Connections”
5.
Right click on a network connection and select “Properties”
6.
Select the “Advanced” tab
7.
Check the box next to “Protect my computer and network by limiting or
preventing access to this computer form the Internet”.
8.
Press “OK”.
9.
Repeat steps 5-8 for each connection listed.
Make the File System More Secure
The next thing you need to do is make sure that your hard
drive partitions are formatted with NTFS (NT File System). This file system is more secure than the FAT
or FAT32 partition schemes.
To check your hard drive
partitions:
Now convert any FAT
partitions on your system:
Tighten Local Security Policies
Windows XP allows you easy access to the basic
security functionality of your system.
The following suggested changes will make your system much more secure.
1.
Log in as an
Administrator
2.
Go to
Start->Programs->Administrative Tools->Local Security Policy
2.1
If you do not see
the Administrative Tools folder, you will need to enable it
2.2.1 Right click the Start Menu and select
properties
2.2.2
In the Taskbar
and Start Menu Properties window, click customize and then click the Advanced
tab
2.2.3
In the Start Menu
Items box scroll down to the System Administrative Tools section, check the box
to the left of Display on All Programs Menu
2.3
Restart at step 2
3
Expand Account
Policies by clicking the + box
4
Select “Password
Policy”
5
Double-click each
policy setting to bring up a new window to make the following changes:
5.2
Enforce password
history - 5 passwords remembered
5.3
Maximum password age
- 0 days
5.4
Minimum password
age - 1 days
5.5
Minimum password
length - 8 characters
5.6
Passwords must
meet complexity requirements - Enabled
5.7
Store password
using reversible encryption for all users in the domain - Disabled
6
Select “Account
Lockout Policy”
6.2
Account lockout
duration - 30 minutes
6.3
Account lockout
threshold - 5 invalid logon attempts
6.4
Reset account
lockout counter after - 30 minutes
7
Expand Local
Policies by clicking the + box
8
Select “Audit
Policy”
8.2
Audit account
logon events- Success, Failure
8.3
Audit account
management- Success, Failure
8.4
Audit directory
service access- No auditing
8.5
Audit logon
events – Success, Failure
8.6
Audit object
access – Failure
8.7
Audit policy
change – Success, Failure
8.8
Audit privilege
use - No auditing
8.9
Audit process
tracking - No auditing
8.10 Audit system events – Success, Failure
9
Select “User
Rights Assignment.” If no change is
noted, do not alter policy setting.
SUPPORT_xxx refers to a built-in help and support account included with Windows
XP, the xxx will be replaced with a different string of letters and numbers on
your machine.
9.2
Access this
computer from the network - Remove Everyone, Remove Power Users
9.3
Act as part of
the operating system
9.4
Add workstations
to domain
9.5
Adjust memory
quotas for a process – Administrators, LOCAL SERVICE, NETWORK SERVICE
9.6
Allow logon
through Terminal Services – Administrators, Remote Desktop Users
9.7
Back up files and
directories - Backup Operators, Administrators
9.8
Bypass traverse
checking - Remove Everyone, Remove Power Users
9.9
Change the system
time - Remove Power Users
9.10 Create a pagefile - Administrators
9.11 Create a token object
9.12 Create permanent shared objects
9.13 Debug programs - Administrators
9.14 Deny access to this computer from the network – Guest,
SUPPORT_xxx
9.15 Deny logon as a batch job
9.16 Deny logon as a service
9.17 Deny logon locally – Guest, SUPPORT_xxx
9.18 Deny logon through Terminal Services
9.19 Enable computer and user accounts to be trusted for
delegation
9.20 Force shutdown from a remote system - Administrators
9.21 Generate security audits – LOCAL SERVICE, NETWORK
SERVICE
9.22 Increase scheduling priority - Administrators
9.23 Load and unload device drivers - Administrators
9.24 Lock pages in memory
9.25 Log on as a batch job
- SUPPORT_xxx
9.26 Log on as a service – NETWORK SERVICE
9.27 Log on locally – Remove Guest, Remove
Power Users
9.28 Manage auditing and security log - Administrators
9.29 Modify firmware environment values – Administrators
9.30 Perform volume maintenance tasks - Administrators
9.31 Profile single process - Remove Power Users
9.32 Profile system performance - Administrators
9.33 Remove computer from docking station - Remove
Power Users
9.34 Replace a process level token – LOCAL SERVICE, NETWORK
SERVICE
9.35 Restore files and directories - Backup Operators,
Administrators
9.36 Shut down the system - Remove Power Users
9.37 Synchronize directory service data
9.38 Take ownership of files or other objects –
Administrators
10
Select
“Security Options”
10.2
Accounts:
Administrator account status - Enabled
10.3
Accounts: Guest
account status - Disabled
10.4
Accounts: Limit
local account use of blank passwords to console logon only - Enabled
10.5
Accounts: Rename
administrator account - <something unique> (REMEMBER THIS: see next section entitled “Segment the User Account
from the Administrative”
10.6
Accounts: Rename
guest account - <something unique>
10.7
Audit: Audit the
access of global system objects - Disabled
10.8
Audit: Audit the
use of Backup and Restore privilege - Disabled
10.9
Audit: Shut down
system immediately if unable to log security audits - Disabled
10.10
Devices: Allow
undock without having to log on - Enabled
10.11
Devices: Allowed
to format and eject removable media - Administrators
10.12
Devices: Prevent
users from installing printer drivers - Disabled
10.13
Devices: Restrict
CD-ROM access to locally logged-on user only - Disabled
10.14
Devices: Restrict
floppy access to locally logged-on user only - Disabled
10.15
Devices: Unsigned
driver installation behavior - Warn but allow installation
10.16
Domain
controller: Allow server operators to schedule tasks - Not defined
10.17
Domain
controller: LDAP server signing requirements - Not defined
10.18
Domain
controller: Refuse machine account password changes - Not defined
10.19
Domain member:
Digitally encrypt or sign secure channel data (always) - Enabled
10.20
Domain member:
Digitally encrypt secure channel data (when possible) - Enabled
10.21
Domain member: Digitally
sign secure channel data (when possible) - Enabled
10.22
Domain member:
Disable machine account password changes - Disabled
10.23
Domain member:
Maximum machine account password age - 30 days
10.24
Domain member:
Require strong (Windows 2000 or later) session key - Enabled
10.25
Interactive
logon: Do not display last user name - Enabled
10.26
Interactive
logon: Do not require CTRL+ALT+
10.27
Interactive
logon: Message text for users attempting to log on
10.28
Interactive
logon: Message title for users attempting to log on
10.29
Interactive
logon: Number of previous logons to cache (in case domain controller is not
available) - 0 logons
10.30
Interactive
logon: Prompt user to change password before expiration - 0 days
10.31
Interactive
logon: Require Domain Controller authentication to unlock workstation -
Disabled
10.32
Interactive
logon: Smart card removal behavior - No Action
10.33
Microsoft network
client: Digitally sign communications (always) - Disabled
10.34
Microsoft network
client: Digitally sign communications (if server agrees) - Enabled
10.35
Microsoft network
client: Send unencrypted password to third-party SMB servers - Disabled
10.36
Microsoft network
server: Amount of idle time required before suspending session - 15 minutes
10.37
Microsoft network
server: Digitally sign communications (always) - Disabled
10.38
Microsoft network
server: Digitally sign communications (if client agrees) - Enabled
10.39
Microsoft network
server: Disconnect clients when logon hours expire - Enabled
10.40
Network access:
Allow anonymous SID/Name translation - Disabled
10.41
Network access:
Do not allow anonymous enumeration of SAM accounts - Enabled
10.42
Network access:
Do not allow anonymous enumeration of SAM accounts and shares - Enabled
10.43
Network access:
Do not allow storage of credentials or .NET Passports for network
authentication - Enabled
10.44
Network access:
Let Everyone permissions apply to anonymous users - Disabled
10.45
Network access:
Named Pipes that can be accessed anonymously – Remove all
10.46
Network access:
Remotely accessible registry paths – Remove
all (unless actively using remote registry)
10.47
Network access: Shares
that can be accessed anonymously - Remove
all
10.48
Network access:
Sharing and security model for local accounts - Guest only - local users
authenticate as Guest
10.49
Network security:
Do not store LAN Manager hash value on next password change - Enabled
10.50
Network security:
Force logoff when logon hours expire - Enabled
10.51
Network security:
LAN Manager authentication level - Send
NTLMv2 response only/refuse LM
10.52
Network security:
LDAP client signing requirements - Negotiate signing
10.53
Network security:
Minimum session security for NTLM SSP based (including secure RPC) clients - No
minimum
10.54
Network security:
Minimum session security for NTLM SSP based (including secure RPC) servers - No
minimum
10.55
Recovery console:
Allow automatic administrative logon - Disabled
10.56
Recovery console:
Allow floppy copy and access to all drives and all folders - Disabled
10.57
Shutdown: Allow
system to be shut down without having to log on - Enabled
10.58
Shutdown: Clear
virtual memory pagefile - Enabled
10.59
System
cryptography: Use FIPS compliant algorithms for encryption, hashing, and
signing - Disabled
10.60
System objects:
Default owner for objects created by members of the Administrators group -
Object creator
10.61
System objects:
Require case insensitivity for non-Windows subsystems - Enabled
10.62
System objects:
Strengthen default permissions of internal system objects (e.g. Symbolic Links)
- Enabled
11
Close the Local Policy Settings window
when done.
Segment the User Account from the
Administrative
One of the main challenges
with managing an operating system is deciding how much authority to grant your
normal user account. The more authority
your normal user account has, the more you can do with the system, including
running malicious applications. Take for
example a trojan program you accidentally run.
If your user account can delete system files, so can the trojan. If you can delete printers and send nasty
email to the police, so can the trojan.
Accordingly, we want to segment the powerful rights we use infrequently
from the common rights we use often.
|
A note about the
Guest account The Guest account is
disabled in Windows XP by default, which is a very good
thing. Enabling the guest account
makes anonymous users guests. If you
share a folder, the default permissions are Everyone having full
control. If guest is enabled, guess
what, Guest (i.e., anonymous) is included in Everyone! You’ll soon have all kinds of fun as people
find your open share and stick all kinds of terrible things on your
system. Always remove the share
permissions from Everyone and add them to Authenticated Users. This is a much safer policy. |
Setup
During the installation
process of Windows XP you were prompted to enter at least one username that would
be created for you and you could use to manage your system. This user account
was created and added as a member of the Administrators group. This is both
insecure and unnecessary as you only need one administrator account. Follow the
steps below to remove this account from the Administrators group and add it to
the Users group so you can use this account for normal day-to-day use. Use user
accounts for normal, day-to-day tasks.
DO NOT use the renamed Administrator account as your normal user account. Logon with the renamed Administrator account
to install programs, printers, create file shares, etc. and logout when you are
done.
1.
Right click on
the account that was created during the install of Windows XP and select
“Properties”.
2.
Select the “Member
Of” tab
3.
You should see
“Administrators” listed in the “Member of” box, if you do not see
“Administrators” then skip the rest of this section. If you do see
“Administrators” then continue on to step 4.
4.
Select
“Administrators” and then press the “Remove” button.
5.
Now press the
“Add” button
6.
This will pop up
a “Groups” dialog box. Type “Users” in the “Enter the object names to select”
box and press “OK”.
7.
Now press “OK” to
close the properties box of the user. You should now login with this account
for normal, day-to-day tasks.
Next, if you need to create
more user accounts for other people to use your machine complete the following
tasks.
1.
Right-click in
the window with the accounts. Select the
“New User” option.
2.
Create a new user
for yourself and for each person who will use the machine locally.
3.
For each new
account, right click and select “Properties.”
Uncheck “User must change password at next logon.”
4.
For each new
account, right click and select “Set Password.”
Make these passwords hard to guess as well.
Make the Local Logon Secure
By default Windows XP allows you to logon to your
computer at the console simply by clicking the name of the account you wish to
logon to. This is obviously insecure and should be changed.
Update Windows Components
The default install of
Windows XP Professional is already out of date.
Microsoft and others have found problems with the XP software. Microsoft provides three ways to update the
base system.
1.
Hotfixes, which fix a specific problem
2.
Service Packs, which are collections of hotfixes
3.
Windows Update, a web based service
You should take advantage of
all three methods to keep the system up to date. Be aware that all three methods are time
sensitive, especially hotfixes. Hotfixes
come out constantly (4 - 6 per month).
You must be proactive when checking for software updates! Don’t just follow the instructions below and
move on. Check your system for
software updates at least once per month.
Remove Unnecessary Windows Components
The more applications that
are installed on your system, the greater the chance of one of them containing
a bug or security flaw. Remove all
unnecessary components.
1. Log in as an Administrator.
2. Go to Start ->Control Panel->Add or Remove
Programs
3. Select “Add/Remove Windows Components.”
4. Remove (uncheck) the following:
Indexing Service
Internet Information Service (IIS)
Management and Monitoring Tools
Message Queuing
MSN Explorer – Select “Yes” at the
dialog box when you are prompted
Networking Services
Other Network File and Print Services
Messenger
Remove Remote Assistance
Remote Assistance provides a
convenient mechanism for support staff to connect to your computer to fix or
diagnose a problem. This convenience, however, reduces the security of your
system and just gives potential hackers an additional avenue to attack your
machine. Unless you actively use this feature you should disable it.
1.
Log in as an Administrator
2.
Open the Start menu and right click “My Computer”
3.
Select “Properties” and click on the “Remote” tab
4.
Uncheck the box next to “Allow Remote Assistance invitations to be sent
from this computer”
5.
Uncheck the box next to “Allow users to connect remotely to this
computer”
6.
Press “OK”
Stop and Disable Unused Services
Just like Windows components,
the more services that are running on your system, the greater the chance of
one of them containing a bug or security flaw.
Stop and disable all unnecessary services.
1.
Log in as an Administrator
2.
Go to
Start->Programs->Administrative Tools->Services
3.
Right click on
the Alerter Service and select “Properties”
4.
Change the Startup type to Disabled
5.
Press the “Stop” button and then press “OK”
6.
Repeat steps 3-5 for the following services if they are not already
stopped and disabled:
a.
Human Interface Device Access
b. Indexing Service
c.
Messenger
d. NetMeeting Remote Desktop
Sharing
e.
Network DDE
f.
Network DDE DSDM
g. Remote Desktop Help Session
Manager
h. Routing and Remote Access
i.
Telnet
Prevent Malware
and Spyware
Viruses,
worms, trojans, and backdoor programs are invented by brilliant people who have
nothing better to do with their time.
Every year these mal (bad) ware (software) programs destroy billions of
files and cost companies millions of dollars.
They may do anything from moving a decimal point in an Excel
spreadsheet, to repeatedly dialing 911 from your modem and clogging needed
emergency services. Prevention,
education, and communication are the cures.
Download
antivirus software:
1.
Log in as an
Administrator
2.
Install the
antivirus software off the VTnet 2004 CD
3.
Use the
LiveUpdate feature of Norton Antivirus to make sure the application and virus
definitions are up-to-date
4.
Scan your entire
system for malicious applications
5.
Make sure that
Norton Antivirus is scheduled to run LiveUpdate weekly
a.
Open Norton
Antivirus
b.
Select the “File”
menu and select “Schedule Updates”
c.
Check the “Enable
scheduled automatic updates”
d.
Use the
“Schedule” button to customize the dates and times of your updates
6.
Make sure that
Norton Antivirus is schedule to scan your system weekly
a.
Open Norton
Antivirus
b.
Expand the
“Scheduled scans” section
c.
Select “New
Scheduled Scan” to start the scheduled scan wizard.
The main source of malware is
via applications delivered through email or chat clients. NEVER blindly run a program
that is sent to you or that you have downloaded from a site without scanning it
for viruses FIRST! Don’t assume that
because you know the sender that an attachment isn’t bad. Plenty of malware today will search a
person’s email address book and sent itself to everyone on the list. Don’t accidentally infect your friends,
parents and relatives! Also, don’t
assume just because the program doesn’t have an .exe extension that it can’t
run. Plenty of other extensions can
launch and do very bad things. If in
doubt, scan it out!
Another class of nasty
programs are those called spyware. These
programs are usually attached to a free program in order to make the developer
some money. They do various things, like
watch what web sites you go to, overlay different links on web pages, and other
sneaky undocumented behavior. They turn
up in the most unlikely of places, like the Dilbert comet-cursor program that
changes what your cursor looks like.
Remove spyware with the free
tool Ad-aware:
1.
Log in as an Administrator
2.
Go to this link: http://www.lavasoftusa.com/
3.
Download and install the latest version
of Ad-aware on the site (currently 6.0).
Be sure to download the latest Ad-aware signature file.
4.
Once installed, run Ad-aware and let it
scan your entire system. Do this at
least once a month.
Be aware that if the program
you originally downloaded relied on some of these spyware components, using
Ad-aware may disable or cause the programs to malfunction.
Physical
Security
If
you leave your computer unattended, you should ensure that no one has the
ability to use it while logged in with your user account.
1.
Log in as your
normal user account
2.
Right-click on
the desktop
3.
Select properties
4.
Select the screen
saver tab
5.
Select a screen
saver to use
6.
Choose a short
wait time (around 10 minutes)
7.
Check the “On
resume, password protect” box
You
should get into the habit of locking your system when you step away from more
than a few minutes. When you need to
lock your system, hit CTRL+ALT+
In Conclusion
Although this document does
not show you every security change possible, it does attempt to make your
system much more secure than the default install. For better or worse,
Microsoft has decided that usability is a higher priority than security. This document aims to help you tighten the
security of your system while maintaining system usability.
Associated Links
|
4help computing consulting |
|
|
Security links |
|
|
Antivirus links |
|
|
Windows 2000 deployment at
VT |
|
|
Microsoft Security website |
Securing Microsoft Windows XP Professional
By Zeb Bowden & Marc
DeBonis
Version 1.3 - 062404