O'Reilly logo

Windows Vista Security: Praxisorientierte Sicherheit für Profis by Marcus Nasarek

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

800
|
Chapter 24: Understanding Windows Vista Security Changes
Identifying Security Options Changes
Security Options enable or disable security settings for a computer. You can follow
these steps to access Security Options in the Local Security Settings console:
1. Click Start, and then click Control Panel.
2. In the Control Panel, click System and Maintenance and then click Administra-
tive Tools.
3. Double-click Local Security Policy.
4. As shown in Figure 24-3, expand the Local Policies node in the left pane and
then click the Security Options node.
Table 24-3 compares the default Security Options settings in Windows XP and Win-
dows Vista. Most new Security Options changes pertain to UAC. In Windows Vista,
UAC is used to enhance security and restrict what applications can be run. In partic-
ular, UAC is designed to block installation of spyware and other types of malicious
programs or at least make the user aware that these programs are trying to install
themselves.
Figure 24-3. Accessing the Security Options node
Table 24-3. Comparing Security Options in Windows XP and Windows Vista
Security option Default setting in Windows XP Default setting in WindowsVista
Accounts: Administrator Account Status Not applicable Disabled
Accounts: Guest Account Status Not applicable Disabled
Accounts: Limit Local Account Use of Blank Pass-
words to Console Logon Only
Enabled Enabled
Accounts: Rename Administrator Account Administrator Administrator
Accounts: Rename Guest Account Guest Guest
Identifying Security Options Changes
|
801
Audit: Audit the Access of Global System Objects Disabled Disabled
Audit: Audit theUse of Backupand Restore Privilege Disabled Disabled
Audit: Shut Down System Immediately If Unable
to Log Security Audits
Disabled Disabled
DCOM: Machine Access Restrictions in Security
Descriptor Definition Language (SDDL) Syntax
Not defined Not defined
DCOM: Machine Launch Restrictions in Security
Descriptor Definition Language (SDDL) Syntax
Not defined Not defined
Devices: Allow Undock Without Having to Log On Enabled Enabled
Devices: Allowed to Format and Eject Removable
Media
Administrators Not defined
Devices: Prevent Users from Installing PrinterDrivers Disabled Disabled
Devices: Restrict CD-ROM Access to Locally
Logged-On User Only
Disabled Not defined
Devices:Restrict FloppyAccess toLocallyLogged-On
User Only
Disabled Not defined
Devices: Unsigned Driver Installation Behavior Warn but Allow Installation Not applicable
Domain Controller: Allow Server Operators to
Schedule Tasks
Not defined Not defined
Domain Controller: LDAP Server Signing
Requirements
Not defined Not defined
Domain Controller: Refuse Machine Account Pass-
word Changes
Not defined Not defined
Domain Member: Digitally Encrypt or Sign Secure
Channel Data (Always)
Enabled Enabled
Domain Member: DigitallyEncrypt SecureChannel
Data (When Possible)
Enabled Enabled
Domain Member: Digitally Sign Secure Channel
Data (When Possible)
Enabled Enabled
Domain Member: Disable Machine Account Pass-
word Changes
Disabled Disabled
Domain Member: Maximum Machine Account
Password Age
30 days 30 days
Domain Member: Require Strong (Windows 2000
or Later) Session Key
Disabled Disabled
Interactive Logon: Do Not Display Last User Name Disabled Disabled
Interactive Logon: Do Not Require
CTRL+ALT+DEL
Not defined Not defined
Interactive Logon: Message Text for Users
Attempting to Log On
Interactive Logon: Message Title for Users
Attempting to Log On
Table 24-3. Comparing Security Options in Windows XP and Windows Vista (continued)
Security option Default setting in Windows XP Default setting in WindowsVista
802
|
Chapter 24: Understanding Windows Vista Security Changes
Interactive Logon: Number of Previous Logons to
Cache (in Case Domain Controller Is Not Available)
10 logons 10 logons
Interactive Logon: Prompt User to Change Pass-
word Before Expiration
14 days 14 days
Interactive Logon: Require Domain Controller
Authentication to Unlock Workstation
Disabled Disabled
Interactive Logon: Require Smart Card Not defined Disabled
Interactive Logon: Smart Card Removal Behavior No action No action
Microsoft Network Client: Digitally Sign Communi-
cations (Always)
Disabled Disabled
Microsoft Network Client: Digitally Sign Communi-
cations (If Server Agrees)
Enabled Enabled
Microsoft Network Client: Send Unencrypted Pass-
word to Third-Party SMB Servers
Disabled Disabled
Microsoft Network Server: Amount of Idle Time
Required Before Suspending Session
15 minutes 15 minutes
Microsoft Network Server: Digitally Sign Commu-
nications (Always)
Disabled Disabled
Microsoft Network Server: Digitally Sign Commu-
nications (If Client Agrees)
Disabled Disabled
Microsoft Network Server: Disconnect Clients
When Logon Hours Expire
Enabled Enabled
Network Access: Allow Anonymous SID/Name
Translation
Not applicable Disabled
Network Access: Do Not Allow Anonymous Enu-
meration of SAM Accounts
Enabled Enabled
Network Access: Do Not Allow Anonymous Enu-
meration of SAM Accounts and Shares
Disabled Disabled
Network Access: Do Not Allow Storage of Creden-
tials or .NET Passports for Network Authentication
Disabled Disabled
Network Access: Let Everyone Permissions Apply
to Anonymous Users
Disabled Disabled
Network Access: Named Pipes That Can Be
Accessed Anonymously
COMNAP, COMNODE, SQL\
QUERY, SPOOLSS, LLSRPC,
browser
netlogon, lsarpc, samr, browser
Network Access: Remotely Accessible Registry
Paths
(Multiple paths defined as
accessible)
(Multiple paths defined as
accessible)
Network Access: Remotely Accessible Registry
Paths and Subpaths
Not applicable (Multiple paths defined as
accessible)
Network Access: Restrict Anonymous Access to
Named Pipes and Shares
Not applicable Enabled
Table 24-3. Comparing Security Options in Windows XP and Windows Vista (continued)
Security option Default setting in Windows XP Default setting in WindowsVista

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required