Can anyone point me at some good resources on Windows hardening? From 2003 upwards.
3
-
Are you looking specifically at either server or desktop?– Scott PackCommented Feb 3, 2011 at 20:15
-
Both, but mainly servers.– user1300Commented Feb 3, 2011 at 20:16
-
1The tools to harden 2000 are 2003 and 2008. Support from Microsoft ended last year.– user185Commented Feb 3, 2011 at 21:04
Add a comment
|
4 Answers
Baseline Server Hardening (aka, start here): http://technet.microsoft.com/en-us/library/cc526440.aspx
Intro to Hardening Server 2000: http://technet.microsoft.com/en-us/library/dd277465.aspx
Hardening Server 2003: http://www.microsoft.com/downloads/en/details.aspx?familyid=8A2643C1-0685-4D89-B655-521EA6C7B4DB&displaylang=en
Infrastructure Threat Modeling Guide: http://technet.microsoft.com/en-us/library/dd941826.aspx
Security Compliance Manager: http://technet.microsoft.com/en-us/library/cc514539.aspx
-
Considering that 2000 has been abandoned, I'm surprised the hardening page still exists. Commented Feb 3, 2011 at 20:42
The Center for Internet Security publishes Benchmark configurations for several operating systems and other products, including: servers, workstations, infrastructure devices, and more.
The United States National Institute of Standards and Technology has published configurations for Windows 7 as the United States Government Configuration Baseline, and for XP/Vista as the Federal Desktop Core Configuration.
-
+1. The NSA also publish their own guidelines, or sometimes (in the case of Win7/Vista) link to other appropriate guidelines that match their standards. nsa.gov/ia/guidance/security_configuration_guides/…– user2213Commented Jul 6, 2011 at 18:03
On the flip side of hardening guides and standards documents, you have the posture assessment angle. These audits can help you either determine how far off standard you are, or how closely you are actually following what you've decided to implement. The two that I have used, and enjoyed are:
- Microsoft Baseline Security Analyzer (MBSA)
- Nessus Audit Policies
MBSA is an installed application that will audit the security of a Windows system, against the Microsoft recommendations, and produce an excellent report.
The Nessus audit files are included as part of a vulnerability scan and will test against the CIS benchmark.
Both tools produce great reports and can really help with your standards development and/or compliance.
answered Feb 4, 2011 at 20:06
As mentioned on this post over on SU, another useful product if you are aiming for a locked down Kiosk is the Trishell Kiosk Edition - worth having a look at as well.
answered Jul 6, 2011 at 10:56
