|
Posted by Roger Abell [MVP] on January 18, 2006, 12:58 am
Please log in for more thread options
Let's take these one by one.
The guide mentions much about the settings so I guess you are saying
that the differences between the v1.x and the v2.0 templates are not
highlighted as "new" or as "changed". Is that it?
The new guides take into account a number of policies that did not
exist for earlier versions. Whether you could find advantage from
those depends on what is deployed in your environment.
The new also has expanded guidance on both usage and custom
reg settings one may want to use for hardening. The number of
policy settings that did exist before but are now with different settings
recommendations is not large.
As to differences in the templates themselves, you could use a simple
difference program against your prior and the new .inf text files.
I previously had a script that parsed to templates and gave a friendly
display of samenesses and differences, but as this is not updated to
the XP SP2 / W2k3 SP1 changes I will keep it private at this point.
Whether you modified sceregvl or not, or want to now, would be
inherently something you would need to examine one-off, but the
number of suggested settings is now expanded.
I am also surprised at the total omission of System Services settings
from the new templates. I can offer two reasons. One is that the
new guidance recommends using the SCW, which itself will spin out
services settings based on server roles. The other is that there is
a potential for problems from people taking the templates and "blindly"
applying them with W2k toolset if the services were set and their
permissions altered per the older behaviors. When we had the
guides for editorial review we did not get the tools and templates,
else I would have a ready answer as to why these are voided, and
whether intended or oversight (but I am asking now).
--
Roger Abell
Microsoft MVP (Windows Server : Security)
MCDBA, MCSE W2k3+W2k+Nt4
> There are changes in the templates but Microsoft doesn't mentioned them...
>
> Where can I get more information about the changes?
> If I allready hardened a server with the old templates, do I have to
> reharden my servers with the new ones?
> Why are the system services not configured in the new templates?
>
> Thank you for your help
> Regards
>
>
>
>
>
| 
XML Sitemap