Blessed Windows Security Templates

From: RUSecure (rusecure_at_earthlink.net)
Date: 12/12/03

  • Next message: dave kleiman: "RE: Blessed Windows Security Templates" 
    To: <focus-ms@securityfocus.com>
Date: Thu, 11 Dec 2003 18:07:14 -0800

    Hello all,

    I have a special request from a client.

    My client is looking for anyone who will help bless the use of ANY
    security Template with use for Windows 2000 and a similar configuration
    as I will describe below. They would love to actually talk to someone
    as well if possible.

    I am on an SAP ITS Web front end engagement, so you can see why I am
    recommending they seriously harden their front-end and back-end Windows
    servers.

    So here is the configuration.

    Win2K SP4 running IIS 5.0.
    SAP ITS Wgate on the front end
    SAP Agate on the backend

    I have NOT hardened anything yet... And desperately want to using
    something the client can repeatedly reproduce for use within their
    organization.

    I am recommending they use a Commercial tool, but that will take time,
    so MMC and templates for now.

    I am suggesting they use one of the Center for Internet Security
    Templates (CIS - www.cisecurity.org) which are the NIST and NSA
    templates for the Wgate servers in the DMZ Agate servers as well.

    I want them to have the ability of checking the systems using the CIS
    tool and have some level of hardening. I also suggest since they do not
    use and security templates on standalone or through AD that they need to
    move to this direction for repeatability and basic security worthiness.
    They can use MMC to manage and apply these templates and command line it
    for reproduction and compliance.

    So has ANYONE used ANY template on a configuration similar to the one I
    listed ? It does NOT have to be SAP as any basic WEB front end using
    IISLockDown with a Static Web server and NOTHING else required except
    Insight Manager and SNMP and PcAnywhere.

    I recommended the following templates:

    Win2KSrvGold_r1.0.1.inf

    Or

    HISECWEB replacement Web_Secure.INF

    Or what comes with Win2K out of the box

    Hisecws.inf.

    Need I say the lack of use hardened servers is of great concern and they
    would desire to find someone that is actually using some "template.inf"
    to secure their environment.

    These servers are going on the Internet... !!!!!!!

    H E L P !

    Cheers,

    MG

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: dave kleiman: "RE: Blessed Windows Security Templates"

    Relevant Pages

    • RE: Blessed Windows Security Templates
      ... I am in a situation where the client has multiple standalone servers that ... I downloaded the secruity templates from MS ... I have a special request from a client. ... tool and have some level of hardening. ...
      (Focus-Microsoft)
    • Re: Blessed Windows Security Templates
      ... Recommending a solution for this client is going to be ... and then tailor the templates as necessary. ... > templates for the Wgate servers in the DMZ Agate ...
      (Focus-Microsoft)
    • Blessed Windows Security Templates
      ... My client is looking for anyone who will help bless the use of ANY ... security Template with use for Windows 2000 and a similar configuration ... Templates which are the NIST and NSA ... templates for the Wgate servers in the DMZ Agate servers as well. ...
      (Security-Basics)
    • Security and Administrative templates
      ... Using security templates I can define security settings and apply them to my ... enforced by the Local Group Policy and how does Local Group Policy decide ... What happens if I apply a security template and that security ...
      (microsoft.public.platformsdk.security)
    • Re: Applying local policy during unattended install
      ... Set the Admin Templates you want on a computer. ... During your unattend install, copy this file ... >> know I can create a security template and run secedit.exe to apply it ...
      (microsoft.public.windows.group_policy)