Leaked source code of windows server 2003
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

171 lines
8.7 KiB

  1. ;Supplies defaults recommendations for SCM UI
  2. ;Specify default system settings where possible
  3. ;If there are SKU differences present the more secure setting
  4. [Version]
  5. signature="$CHICAGO$"
  6. [Service General Setting]
  7. PlaceHolder,4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
  8. [Registry Keys]
  9. "PlaceHolder",2,"D:PAR(A;CI;KA;;;BA)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
  10. [File Security]
  11. "PlaceHolder",2,"D:PAR(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;BU)"
  12. [System Access]
  13. ;----------------------------------------------------------------
  14. ;Account Policies - Password Policy
  15. ;----------------------------------------------------------------
  16. MinimumPasswordAge = 0
  17. MaximumPasswordAge = 42
  18. MinimumPasswordLength = 0
  19. PasswordComplexity = 0
  20. PasswordHistorySize = 0
  21. RequireLogonToChangePassword = 0
  22. ClearTextPassword = 0
  23. LSAAnonymousNameLookup = 0
  24. EnableGuestAccount = 0
  25. ;----------------------------------------------------------------
  26. ;Account Policies - Lockout Policy
  27. ;----------------------------------------------------------------
  28. LockoutBadCount = 0
  29. ;ResetLockoutCount = 30
  30. ;LockoutDuration = 30
  31. ;----------------------------------------------------------------
  32. ;Local Policies - Security Options
  33. ;----------------------------------------------------------------
  34. ;DC Only
  35. ;ForceLogoffWhenHourExpire = 0
  36. ;NewAdministatorName =
  37. ;NewGuestName =
  38. ;SecureSystemPartition
  39. ;----------------------------------------------------------------
  40. ;Event Log - Log Settings
  41. ;----------------------------------------------------------------
  42. ;Audit Log Retention Period:
  43. ;0 = Overwrite Events As Needed
  44. ;1 = Overwrite Events As Specified by Retention Days Entry
  45. ;2 = Never Overwrite Events (Clear Log Manually)
  46. [System Log]
  47. MaximumLogSize = 16384
  48. AuditLogRetentionPeriod = 0
  49. RetentionDays = 7
  50. RestrictGuestAccess = 1
  51. [Security Log]
  52. MaximumLogSize = 16384
  53. AuditLogRetentionPeriod = 0
  54. RetentionDays = 7
  55. RestrictGuestAccess = 1
  56. [Application Log]
  57. MaximumLogSize = 16384
  58. AuditLogRetentionPeriod = 0
  59. RetentionDays = 7
  60. RestrictGuestAccess = 1
  61. ;----------------------------------------------------------------------
  62. ; Local Policies\Audit Policy
  63. ;----------------------------------------------------------------------
  64. [Event Audit]
  65. AuditSystemEvents = 0
  66. AuditObjectAccess = 0
  67. AuditPrivilegeUse = 0
  68. AuditPolicyChange = 0
  69. AuditAccountManage = 0
  70. AuditProcessTracking = 0
  71. ;AuditDSAccess = 0
  72. AuditAccountLogon = 1
  73. AuditLogonEvents = 1
  74. ;----------------------------------------------------------------
  75. ;Registry Values
  76. ;----------------------------------------------------------------
  77. [Registry Values]
  78. ; Registry value name in full path = Type, Value
  79. ; REG_SZ ( 1 )
  80. ; REG_EXPAND_SZ ( 2 ) // with environment variables to expand
  81. ; REG_BINARY ( 3 )
  82. ; REG_DWORD ( 4 )
  83. ; REG_MULTI_SZ ( 7 )
  84. MACHINE\System\CurrentControlSet\Control\Lsa\AuditBaseObjects=4,0
  85. MACHINE\System\CurrentControlSet\Control\Lsa\CrashOnAuditFail=4,0
  86. MACHINE\System\CurrentControlSet\Control\Lsa\DisableDomainCreds=4,0
  87. MACHINE\System\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymous=4,0
  88. MACHINE\System\CurrentControlSet\Control\Lsa\ForceGuest=4,0
  89. MACHINE\System\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy=4,0
  90. MACHINE\System\CurrentControlSet\Control\Lsa\FullPrivilegeAuditing=3,0
  91. MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse=4,1
  92. MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel=4,0
  93. MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinClientSec=4,0
  94. MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinServerSec=4,0
  95. MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash=4,0
  96. MACHINE\System\CurrentControlSet\Control\Lsa\NoDefaultAdminOwner=4,1
  97. MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous=4,0
  98. MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM=4,1
  99. MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths\Machine=7,Software\Microsoft\Windows NT\CurrentVersion\Print,Software\Microsoft\Windows NT\CurrentVersion\Windows,System\CurrentControlSet\Control\Print\Printers,System\CurrentControlSet\Services\Eventlog,Software\Microsoft\OLAP Server,System\CurrentControlSet\Control\ContentIndex,System\CurrentControlSet\Control\Terminal Server,System\CurrentControlSet\Control\Terminal Server\UserConfig,System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration,Software\Microsoft\Windows NT\CurrentVersion\Perflib,System\CurrentControlSet\Services\SysmonLog
  100. MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths\Machine=7,System\CurrentControlSet\Control\ProductOptions,System\CurrentControlSet\Control\Server Applications,Software\Microsoft\Windows NT\CurrentVersion
  101. MACHINE\System\CurrentControlSet\Control\Lsa\SubmitControl=4,0
  102. MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4,0
  103. MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel\ObCaseInsensitive=4,1
  104. MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown=4,0
  105. MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode=4,1
  106. MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems\optional=7,Posix
  107. MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,0
  108. MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4,0
  109. MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableForcedLogOff=4,1
  110. MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\AutoDisconnect=4,15
  111. MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess=4,1
  112. MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPipes=7,COMNAP,COMNODE,SQL\QUERY,SPOOLSS,LLSRPC,EPMAPPER,LOCATOR,TrkWks,TrkSvr
  113. MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionShares=7,COMCFG,DFS$
  114. MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature=4,1
  115. MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature=4,0
  116. MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword=4,0
  117. MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity=4,1
  118. MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange=4,0
  119. MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\MaximumPasswordAge=4,30
  120. MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange=4,0
  121. MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SignSecureChannel=4,1
  122. MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SealSecureChannel=4,1
  123. MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireSignOrSeal=4,1
  124. MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireStrongKey=4,0
  125. MACHINE\Software\Microsoft\Driver Signing\Policy=3,1
  126. MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,0
  127. MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName=4,0
  128. MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption=1,""
  129. MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText=7,""
  130. MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ScForceOption=4,0
  131. MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon=4,1
  132. MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UndockWithoutLogon=4,1
  133. MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=4,0
  134. MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand=4,0
  135. MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateCDRoms=1,0
  136. MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateDASD=1,0
  137. MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateFloppies=1,0
  138. MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount=1,10
  139. MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceUnlockLogon=4,0
  140. MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14
  141. MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption=1,0
  142. MACHINE\Software\Policies\Microsoft\Cryptography\ForceKeyProtection=4,0
  143. MACHINE\Software\Policies\Microsoft\Cryptography\PasswordCacheTimeout=4,300
  144. MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\AuthenticodeEnabled=4,0