Outcome 3: Implement secure network administration procedures

Table of Contents

1. Windows Server 2003 Security Features
   1. Physical Access
   2. Principle of Least Privilege
   3. Develop a Security Policy
   4. Security Baseline Settings
   5. Microsoft Baseline Security Analyzer
   6. Using the GUI Version of MBSA
   7. Security Templates
   8. Built-in Security Templates
   9. Group Membership and Privileges
   10. Secure Local PC Systems
   11. Securing the SAM Database
   12. Enforce a Strong Password Policy
   13. Do Not Run Unknown programs
   14. Keep Virus Software up-to-date
   15. Keep Operating System Current
2. NTFS File and Folder Permissions
3. Software Update Infrastructure
4. Network Protocol Security
5. Self Assessment Questions (SAQs)
6. Summary: Implementing secure network administration procedures
7. Summary: Software Update infrastructure

Securing the SAM Database

The Security Account Manager (SAM) Database is stored in the registry on workstations and member servers. It stores the usernames and passwords for the domain or local workstation.

As this database contains usernames and passwords it is of extreme importance. If an intruder could gain access and retrieve domain usernames and passwords, especially for the administrator account, then he or she could have full access to the network.

Attackers know that the administrator username and password is the target to aim for and the SAM is the first place they will usually try to access. There are numerous password-cracking programs specifically designed to gain access to the SAM database usernames and passwords. Microsoft recommends using the syskey utility to protect the SAM. This program encrypts the SAM database to make it more difficult to crack.

When you run the syskey.exe utility, you will see the dialog box shown in the first screenshot below. This shows if the SAM database encryption is enabled or disabled. In this case, it is already enabled. If you click Update, you will see the dialog box shown in the second screenshot.

The syskey utility

Startup Key

The Update box allows you to view your current syskey settings as well as change them. As you can see from the picture, this system is currently set to store the syskey locally, as part of the operating system. With this setting both encryption and password are transparent to the user. The other two options are to require the syskey to be entered each time the system starts or to have the syskey located on a floppy disk that must be inserted when the system boots. While these might be a bit extreme for regular PC, they are good ways of protecting domain controllers.

Next: Enforce a Strong Password Policy