Information Security Office

Office of Information Technology

Windows 2003 Server Security

Windows 2003 Server Checklist

This checklist contains server hardening procedures for Windows 2003 Server. The procedures listed in this document are a balance of industry best practices and the unique minimum requirements of UTSA’s computing environment. Since Windows 2003 Server does not come configured securely out of the box, it is necessary to follow these steps to prevent attacks from exploiting known vulnerabilities. In the event that the minimum requirements cannot be met, exceptions must be documented on this document in the area provided (Minimum Requirements Exceptions). In all cases this document must be retained for compliance and future reference. The checklist is available for download (Windows 2003 Checklist - DOC). The checklist should be downloaded and kept for your records for audit and compliance requirements.

Preparation

Before installing Server 2003, please contact the Information Security Office for permission to add a server onto the UTSA network.  Once permission has been granted, the server will have a static IP Address assigned to your host.  The request for a static IP Address can be made online at http://www.utsa.edu/infotech/NS/iprequest.htm or by contacting the UTSA Help Desk (x5538).

Physical Security

Physical server security is as important as logical server security. The server console should be protected to maintain confidentiality, integrity and availability.

CAT 1

The following access controls are required for servers containing Cat1 data or sensitive data as classified by the Data Classification Standard:

• Electronic access control mechanisms must be in place to audit the access to the room where the server resides.
• Access to the room should be minimized to authorized administrators of the system(s).
• The console should be locked when not in use.
• If the area where the server resides is an “open” unrestricted area, a rack system should be used to secure the server and a bios password needs to be configured.

CAT 2/3

The following access controls are required for servers containing Cat 2/3 data.

• The console must be locked when not in use.
• The server should reside in an area that has minimal access

Installation

If a server is a new install, protect it from hostile network traffic, until the operating system is installed and hardened.  Consider using the Security Configuration Wizard to assist in hardening the host. 

Server Packs and Hot Fixes

Audit and Account Policies

http://www.microsoft.com/technet/security/guidance/serversecurity/tcg/tcgch02n.mspx

5.   Configure Audit Policy

Configure a strong audit policy.  Successful and failed logins, as well as privilege use, should be logged and monitored to detect any unauthorized activity. 

The UTSA Information Security Office recommends the following Auditing settings:

6.  Set Password Length and Complexity

Use the Domain Security Policy (or Local Security Policy) snap-in to strengthen the system policies for password acceptance, including:

7.  Configure Event Log

Security Settings

http://www.microsoft.com/technet/security/guidance/serversecurity/tcg/tcgch05n.mspx

11.  Local Administrator Password Length and Complexity

• Password must contain at least 10 characters
• Set a minimum password age of < 90
• Set a password history maintenance
• Password must contain both upper and lower case characters as well as letters
• Password must contain special characters   
• Passwords must not be based on personal information; must not be a word in any language, dialect, jargon, etc.

12.  Local Administrator Account Password Policy

• Enable account lockout on the local administrator account
• Rename the local Administrator account to something other than Administrator

14.     University Warning Banner

                              ******  University of Texas at San Antonio ******

                            Warning ! Warning ! Warning ! Warning !

 This system is for the use of authorized users only. Use of this computer without

explicit authority, or in access of authority, is subject to tracking, monitoring and

preservation of evidence.  As a result the individual may be subject to criminal prosecution

and/or disciplinary action.

Additional Security Protection

©The University of Texas at San Antonio One UTSA Circle San Antonio TX 78249
Revised: 02/01/2008
Refer Comments to: oit@utsa.edu
Identity Guidelines | Policies | Emergency Preparedness | Required Links