HackNotes Windows Security Portable Reference phần 8 potx

Group Policy–based Software Settings are typically used to support software deployment services in very large environments and to define installation packages that domain members can obt

Trang 1

or Windows XP Professional SP1 with the NET Framework The GPMC

and supporting documentation can be obtained from http://www

.microsoft.com/windowsserver2003/gpmc/default.mspx We will look at

the GPMC a little more closely when we discuss applying GPOs to domain

objects later in this chapter For now, we’ll stick to the default MMC

snap-in

Group Policy Settings

We have already discussed some of the settings available within a GPO

in Chapter 9 The Local Security Settings management console exposes

settings from the Local GPO under Computer Configuration |

Win-dows Settings | Security Settings Table 10-1 shows the top categories of

the Group Policy object, and the types of settings they offer in both the

Computer Configuration and User Configuration trees

Group Policy–based Software Settings are typically used to support

software deployment services in very large environments and to define

installation packages that domain members can obtain directly from

Chapter 10: Domain Security with Group Policies 159

Color profile: Generic CMYK printer profile

Composite Default screen

Trang 2

the domain controllers This is frequently used in conjunction with

software restriction policies (under the Windows Settings | Security

Settings tree) to help manage software licensing compliance

The Windows Settings tree of the Local GPO exposes the local

secu-rity settings discussed in Chapter 9 When working with GPOs applied

to AD objects, there are additional settings exposed that consolidate

some of the other system configuration options that typically play a part

in system hardening Figure 10-2 depicts the Security Settings from a

default domain Group Policy Object As you can see, above the Local

GPO level, the Windows Settings can define such policies as which

Sys-tem Services should be disabled or enabled, which Registry and File

System permissions can be applied, and which local-system group

membership can be fine-tuned for domain users

The Administrative Templates tree encompasses the policies for the

vast majority of Windows components, including applications such as

Internet Explorer and NetMeeting, system services such as Terminal

Services and Task Scheduler, and system-level configurations such as

restrictions on local network connections, system script execution, and

system logon properties As is the case with the other GPO trees, the

set-Software Settings

(Empty on Local

GPOs)

Allows definition ofsoftware packages andinstallation settings that areapplied at the system level

to any computers subject

to this policy, regardless oflogged-in user

Software packages andinstallation settings thatare available based onthe logged-in user

Windows Settings Allows definition of system

startup and shutdownscripts, the computer-levelsecurity settings discussed

in Chapter 9, andadditional local operatingsystem options

Controls user-interfaceaspects of the operatingsystem, such as logon/

logoff scripts,management(redirection) of systemfolders, and InternetExplorer customizationsand controls

Administrative

Templates

Contains a variety ofconfiguration optionsthat affect core Windowsservice and utilityofferings, defined onthe computer level

With similar groupings

to the computerconfiguration, the Userconfiguration allowsmore granular tuning

of user-exposed optionsfor the core Windowsofferings

Table 10-1. The Three Group Policy Object Settings Trees

P:\010Comp\HackNote\785-0\ch10.vp

Trang 3

tings under Computer Configuration tend to be more general, such as

enabling or disabling certain functionality, while the User

Configura-tion settings tend to be more diverse (and complicated), allowing

fine-tuning of core system behaviors

With the immense number of settings available in group policies, it

would be neither feasible nor advisable to document all of them in

this text Microsoft maintains an up-to-date Group Policies settings

reference for the most complicated Administrative Templates tree,

which can be found at the TechNet Group Policies homepage, http://

www.microsoft.com/technet/grouppolicy/ This document, supplied

as an Excel spreadsheet, lists all the GPO settings within Administrative

Templates and the operating systems (and service pack levels) to which

they can be applied In addition to this resource, the help facilities

pro-vided within group policy objects are very well implemented,

particu-larly so in the Administrative Templates tree, where context-sensitive help

is often displayed in the MMC’s extended panel view (see Figure 10-3)

The Local GPO can provide administrators a canvas for testing the

impact of group policies by allowing configuration of the majority of the

settings that are available on the domain level without having to

contin-ually edit and reapply domain-level group policy objects Settings not

exposed in the Local GPO, such as the additional permissions

capabili-ties in Security Settings, can usually be implemented on the local system

through some other facility However, such testing should be

con-ducted only on systems that are not domain members to prevent

do-main GPOs from overriding the local GPO

Figure 10-2. The Security Settings tree on a Domain GPO offers centralized control of

more client settings than the Local GPO

Trang 4

Configuring Individual Group Policy Settings

Group policy settings are not restricted to simple “On/Off” type

con-trols, as you know from working with the Local GPO Each setting’s

format is defined by its content—for example, to configure registry

permissions settings, you specify the key that you want to apply

per-missions to, and then adjust user and group perper-missions for the entry as

if you were using the Registry Editor The policy settings in all trees of

the GPO are configured with standard Windows properties dialog

boxes, such as that in Figure 10-4 The Explain tab on these dialog

boxes includes the detailed descriptions that can be shown in the

Ex-tended view (shown in Figure 10-3), and the Next Setting/Previous

Setting buttons allow the user to walk through the settings in any

folder of the tree

Most settings in the GPO will either take the form of the DNS suffix

setting shown in Figure 4 or will provide a list (sometimes empty) of

policy definitions More complicated settings, such as IP security

poli-cies and file or registry permissions, will take this latter form The

im-portant concept common to both of these methods is the transparency

of “Not Configured,” or with more complicated policies, the lack of

any setting at all In the absence of a specific directive from a GPO,

nothing will be applied, and the specific operating system’s defaults

will be in effect

Figure 10-3. The extended panel view help in the Administrative Templates tree of

the GPO

Trang 5

WORKING WITH GROUP POLICIES

IN ACTIVE DIRECTORY

Group Policy Objects show their true power only when applied to an

Active Directory site, domain, or OU While the local GPO has its

pur-poses for standalone systems, the greatest administrative benefits are

derived when GPOs are used to quickly and easily deploy system

secu-rity to groups of users and systems from a central location In this

sec-tion, we will see how to manage and deploy group policies across AD

Figure 10-4. Setting the properties for a Group Policy Setting

Trang 6

Both Windows Server 2000 and 2003 domain controllers are deployed

out of the box with a Default Domain Policy GPO This GPO is applied

to all domain members unless they have been specifically excluded by

editing the GPO’s permissions AD-based GPOs are edited with the

same Group Policy Object Editor management console snap-in that we

used to access the Local GPO but can be indirectly accessed through the

properties of a site or domain, as so:

■ From Administrative Tools, open either the Active Directory

Sites and Services applet or the Active Directory Users andComputers applet

■ In the site/domain tree view, right-click the domain whose

GPOs you wish to edit and select Properties

■ Click the Group Policy tab (shown in Figure 10-5)

If you have already installed the Group Policy Management

Con-sole (described earlier in the chapter) you will see a different dialog box

than the one in Figure 10-5; you will see one that directs you to use the

GPMC for working with Group Policy Objects We’ll discuss the GPMC

Figure 10-5. The Managing AD–based Group Policy Objects from the Domain Properties

dialog box is superseded when GPMC is installed

Trang 7

in a moment From the dialog box in Figure 10-5, we can manage the

ap-plication of the Default Domain Policy Any Group Policy Objects listed

in the Properties dialog box will be applied to all members of this site/

domain/OU (according to permissions) unless the GPO is marked

Dis-abled The controls on the Group Policy dialog box are used as follows:

■ New Adds a new GPO to the Active Directory site/

domain/OU

■ Add Allows an administrator to link a GPO from another

site/domain/OU

■ Edit Brings up the Group Policy Editor MMC snap-in,

focused to the selected GPO

■ Options… Provides controls to set the No-Override option

for a GPO or to disable the GPO’s link to the site/domain/OU

■ Delete… Removes the selected GPO, either by simply

unlinking and removing it from the list or by physicallydeleting the GPO definition

■ Properties Allows configuration of the GPO’s access

permissions, defining WMI filters to limit application of thepolicy, or determining what other sites/domains/OUs arelinked to this GPO

■ Up / Down Sets the order in which listed GPOs are applied

to clients Recall that the GPOs applied last take precedence,

so this allows administrators to control the application orderfor the GPOs defined in the site/domain/OU

■ Block Policy Inheritance Sets whether or not this policy will

try to prevent any settings defined within from being replaced

by a subsequent policy GPOs defined with the Enforced orNo-Override options enabled will ignore the Block PolicyInheritance option

Controlling Who Is Affected by Group Policies

Of these controls, the Properties settings deserve our closest attention

because the permissions defined for a GPO are how an administrator

can control what users and groups are subjected to the policies defined

within The Security tab of this dialog box is shown in Figure 10-6

As shown, the group Authenticated Users (an automatic group

con-sisting of all users with valid credentials) have the Read and Apply

Group Policy rights enabled for the Default Domain Policy These are

the two rights required for a GPO to be applied, so all users are subject

to the Default Domain Policy To reduce the scope of a given GPO, we

must remove one or both of these rights from the Authenticated Users

Trang 8

group and assign the Read and Apply Group Policy rights for the users

and groups for whom we want the GPO to apply This is the

counter-intuitive rights assignment we mentioned at the introduction of the

chapter, which further stresses the importance of well-planned GPO

implementation

Using the Group Policy Management Console

Users of Windows Server 2003 and Windows XP Professional (SP1, with

.Net Framework) can install the new Group Policy Management

Con-sole to get better control over their AD-based Group Policy Objects As

we just saw, Windows 2000 group policy management was

accom-plished on a local level; the interface is accessed from the properties of a

given site, domain, or OU As such, understanding the relations

be-tween GPOs implemented at different levels of the directory can be very

challenging, particularly in complex AD forests

Enter the Group Policy Management Console Implemented as a

new MMC snap-in, the GPMC presents a unified view of all group policies

Figure 10-6. The security properties of a Group Policy Object

Trang 9

in the Active Directory, or at least all the GPOs that the user running

GPMC has Read access to The GPMC provides new functionality such

as GPO Import/Export and Backup/Restore capabilities, and simple

reporting that greatly eases administrative troubleshooting and

plan-ning The tool can be downloaded from http://www.microsoft.com/

windowsserver2003/gpmc/default.mspx After installation, the GPMC

can be accessed from Start | Administrative Tools | Group Policy

Man-agement

When defining group policies with the GPMC, many of the nuances

that have complicated GPO deployment are smoothed over For

exam-ple, GPMC provides a more simple method of filtering what users and

groups should apply a given policy by hiding the raw permissions

edit-ing that we discussed earlier The administrative permissions we saw in

Figure 10-6 are separated from this security filtering and are displayed

on the Delegation tab of a policy’s properties panel If you miss the

old-style security properties dialog box, it can be accessed from the

Advanced button on the Delegation tab

Some of the most exciting features of the GPMC are the options

pre-sented for group policy reporting Selecting the Settings tab for any

GPO in the GPMC generates an HTML report showing only the security

settings that are actually defined in the GPO This provides

administra-tors a great tool for troubleshooting GPO-based permissions issues

or for simply performing quick audits Figure 10-7 shows the GPMC

open to the Settings report for the Default Domain Policy for the domain

corporate.hacknotes.local In addition to mapping the properties of a

single GPO, the GPMC can also help you develop group policies with

Group Policy Modeling or quickly generate a report on the end result of

GPO application using the Group Policy Results wizard Both of these

tools evaluate the various GPOs that an actual (or hypothetical) user

and computer would be subjected to and display the end result for the

includ-Since the GPMC can be installed on a Windows XP workstation and used tomanage group policies in the Active Directory (provided the logged-in user has suf-ficient permissions), this tool is largely superseded However, many of the otherutilities are very useful, and are worth checking out The tools can be obtained fromhttp://www.microsoft.com/windows2000/techinfo/reskit/default.asp

Trang 10

In this chapter, we have presented only the most basic uses of group

poli-cies, as our objective was to introduce the concepts and tools involved As

your group policy definitions become more secure, they will also become

more complex Newly implemented controls can incur help-desk calls

that will eventually bring about new exceptions Without careful

plan-ning, the system can quickly grow unmanageable, but properly

man-aged, group policies are one of the most powerful anti-hacker munitions

in the administrator’s arsenal

Even if the only policy being used is the Default Domain Policy to

enforce some basic Internet Explorer security settings, administrators

can still use this GPO to rapidly deploy security solutions to react to

new threats Many of the settings we’ve discussed already, along with

the Windows security tools we will discuss in the following chapters,

can all be implemented from within Group Policy Objects, allowing

ad-ministrators to deploy advanced network and file system security

net-work wide with minimal effort In Chapter 11, we will cover the options

available for maintaining Windows operating system security through

careful patch management, another security tool that can be managed

using the group policies we’ve just discussed

Figure 10-7. The Group Policy Management console—Policy Settings report

Trang 11

Trang 12

IMicrosoft began promoting their renewed commitment to security

with a simple message: “Get Secure, Stay Secure.” This directive

clearly defines the two phases of implementing a secure

system—prep-aration and maintenance As we’ve seen in previous chapters, there is a

great deal that we can do within the operating system to prevent

unau-thorized access and to control an authenticated user’s ability to access

restricted resources Many of the techniques we discussed in the

previ-ous chapters provide a second level of defense—limiting permissions of

legitimate users so that attackers with stolen credentials (or perhaps

dis-gruntled users) cannot easily obtain escalated privileges or access

sensi-tive materials Now that we’ve “got secure,” let’s take a look at our

options for staying secure

Before we begin, a brief note Staying secure isn’t solely about

man-aging patch levels To ensure your servers are prepared for the worst

the network can offer, you must keep your ear to the ground and

ac-quaint yourself with the various security news sources (If you don’t yet

have a favorite, consult the Reference Center for some of ours.)

Occa-sionally, serious security issues can surface for which there is no

imme-diate fix In these cases, your current patch levels may be irrelevant, and

you may need to take manual steps to protect against the threat No

patch management plan can take the place of awareness

HISTORY OF WINDOWS

OPERATING SYSTEM UPDATES

Prior to the introduction of the Windows Update site, maintaining all

security patches on even a single server was challenging The

adminis-trator needed to keep track of installed patches and had to evaluate each

new patch to see if it applied to his system Many large organizations

in-vested untold fortunes into the constant development and refinement

of scripts that could ensure that all networked systems had applied

patches deemed critical, investing in third-party software management

packages or Microsoft Systems Management Server

The Microsoft Windows Update site opened to a pensive audience

as Microsoft was ushering users to the Windows 2000 operating

sys-tems Despite repeated assurances, many users were wary of an

auto-mated update tool Rumors spread rapidly of malicious copy protection

schemes that could collapse corporate networks, stolen credit card

numbers, and UFOs over Redmond In time, however, Windows

Up-date began to steadily grow in popularity as more patches were

required for various Windows 2000 services more and more

fre-quently Soon after, Microsoft made the Critical Update Notification

Trang 13

utility available, a tool that checked with Microsoft’s update site on a

regular schedule and advised the user of patch availability

As Windows 2003 Server development wrapped up, the logical

pro-gression of Critical Update Notification and Windows Update finally

came to pass, and suddenly Windows 2000 SP3 and Windows XP

sys-tems not only were capable of obtaining patches unattended, but could

even install them (note that some updates may require a reboot before

they are completely applied) Automatic updates can be a great time

saver for many administrators, depending on the type of environment

they operate in

AUTOMATIC OR MANUAL?

Some environments dictate patch management methods that may

ap-pear to preclude the use of Automatic Updates Secured environments

with no external network access, organizations that require patches to

be locally certified before deployment, or sites with bandwidth

limita-tions usually cannot take advantage of automatic updates without the

use of additional software and/or homegrown solutions Then there are

the power users who resist any changes to their system configuration

(“I swear—I just came in this morning, and the machine had just fallen

off of the domain!”)

Manual updating, diligently maintained, can be just as successful as

automatic updating Unfortunately, most users are not so diligent, and

weeks or months can pass between a user’s visits to the update site

While servers are often carefully patched by their administrators,

net-work clients rarely receive the same degree of attention In the author’s

experience, the most critical time for attacks with new vulnerabilities is

usually not the first 48 hours—during this time, knowledge of any

working exploits is usually limited Within a few days of the

vulnerabil-ity’s initial public disclosure, the exploit is more widespread, and the

actual risk of attack continues to increase steadily over time In some

cases, a worm may take advantage of the exploit, and with autonomous

attackers randomly probing network addresses, the likelihood of attack

becomes quite high This is the distinct advantage of automatic updates;

they can dramatically lower the average time to patch, minimizing the

chance of exposure to a new security issue due to lax administration

Regardless of whether you use the new Automatic Updates features

to keep your systems up to date or trust your users and administrators

to do so manually, you will still not have the capability of centrally

doc-umenting your exposure If you require features like guaranteed

deliv-ery of updates or centralized reporting, there is no alternative to using

SMS or another system management package The update methods we

present in this chapter will not offer these kinds of capabilities

Chapter 11: Patch and Update Management 171

Trang 14

Applying baseline system security updates to a single Windows 2000 or

higher system is a breeze, if you have enough bandwidth Simply open

Internet Explorer and connect to the Windows Update site at http://

www.windowsupdate.com Typically, patches can only be installed by

members of the Administrators group (domain or local system), so you

will want to log in with the proper credentials first

Windows Update uses an ActiveX control to ascertain limited

sys-tem information, which it then uses to determine what updates are

available for your installation The Windows Update scan process is

shown in Figure 11-1 Microsoft does maintain a small amount of

infor-mation from this transaction, but we will direct you to view the current

Privacy Policy document if you have any concerns about this activity,

in case there have been any changes since publication Windows

Up-date also assists you in managing patch application, with such

fea-tures as disabling the selection of options that cannot be installed

simultaneously and directing you to install the latest service pack

prior to recent hot fixes

Figure 11-1. Windows Update scanning for updates

Định dạng
Số trang	29
Dung lượng	879,17 KB