In this video I will look at the security settings part of Group Policy and how they
can imported and exported using a security Template. If you have been working with computers since
Windows XP, you may remember there being a security template that could be applied to
Windows XP. This security template changed the local security setting on Windows XP to
make it more like Windows 2000. These changes were required in some cases to get old software
to run. You could also get other security templates which could be applied to the computer
which would strength the security of the computer. Microsoft does not release Security Templates
like these for modern operating system as the need for these has been replaced by other
tools. One such tool, The Security Configuration Wizard I will look at in the next video. Regardless
of whether you use security templates or not, this video will give you a good understanding
of how local security on a computer is configured and can be exported and imported to other
computers if required. Every Windows based computer has a local Group
Policy. This local Group Policy contains general settings for the computer as well as security
settings. When configuring security in your domain, when possible you want to configure
the security using Group Policy at the domain level. This provides centralized control making
it easier to change later on. In some cases this may not be possible, for example you
have a computer that is not a member of the domain, when this occurs, you will need to
use the Local Group Policy. In some cases you may want to use local group policy if
you only want to apply settings to the one server or you want to test a setting
on the one server before changing the settings at the domain level.
Local Group Policy settings work the same as they would if they were configured at the
domain level expect on Domain Controllers. This is because when the server
is promoted to a Domain Controller, the local user account database
is disabled. For this certain local security settings on a Domain Controller are ignored.
I can open the local Group Policy editor from the start menu. The security settings are
found under Computer Configuration, Windows Settings, Security Settings. These security
settings define local security on the computer. This relates to local resources on the computer
like a local user account. For example, if you created a local user account on the computer,
you could define settings under security settings like how many days a password can be used
on a local account until it needs to be changed and how complex this password would need to
be. If I go back to the start menu and open Local
Security Policy from Administrative tools under the start menu, you may think that the
Security Settings found here and in the local Group Policy look the same. You may think
this because the settings are in fact the same settings.
When you edit the security settings in Local Security Policy you are in fact editing the
security settings found in the local Group Policy found here. Local Security Policy
gives you a subset of the settings found in the local Group Policy. In other words, it
only shows you the local Group Policy settings that relate to local security.
If I expand into Accounts Policy, you will notice that you can configure some settings
relating to Password Polices for user accounts on the local computer. As we already know
from previous videos, when you promote a server to a Domain Controller the local user account
database on that server is no longer used. What this essentially means is that a Domain
Controllers can only use domain accounts and thus the Security Settings found in here have
no effect on the Domain Controller. This brings up the question, how would you
configure user security settings on a Domain Controller when a Domain Controller can only
use Domain accounts? If I open Group Policy Management from the start menu, and then select
the Domain Controller OU, on the right hand side you can see that Default Domain Controller
Policy. This policy is created by default when the domain is created. You may have wondered
why there was a need for this Group Policy. This Group Policy is needed to configure security
settings on the Domain Controller since the local Group Policy cannot be used to configure
the Domain accounts that are used on a Domain Controller.
If I edit the Group Policy and go to the security settings for this Group Policy. These security
settings are used for the Domain Controllers in the domain rather than the security settings
found in the local Group Policy. By doing this, this improves security for Domain Controllers.
It should be noted that this only applies to security settings. You are free on a Domain
Controller to configure any other local Group Policy settings outside security settings
and these will be read and applied when Group Policy is processed on that Domain Controller,
only Security Settings are exempt from this process.
Once you have your security setting configured, you may want to use these on a different computer.
To demonstrate how to do this, I will change to my Windows Server that is running on my
DMZ. Since this server is running on my DMZ or
perimeter network, I have not made it a member of the Domain. Since this server will be accessible
from the internet, not having it in the domain will help protect the rest of the network
if this server was to be compromised. A lot of time has gone into configuring the
security settings on this server. A second DMZ server has been added to the network for
fault tolerance, so the same security settings that were applied to this server should be
applied to that server. In order to achieve this I will first open
Local Security Policy from Administrative Tools under the start menu. If I right click
Security Settings at the top, I can export the settings configured on this server to
an INF file. I will save this file on a file share so that is can be used later on.
Now that the security settings have been saved I will now change to the backup DMZ server
to apply these settings to that server. First of all, I will open the file share that
I exported the security settings to and copy this file to the desktop of this server. In
order to import the file, I will next open Local Group Policy from the start menu.
To import the settings, all I need to is right click on Security Settings and select the
option import policy. From here is a simply matter to browse to the security template
file and select open and it will be imported. The problem with this approach is that you
do not know if any changes have already been made on the local computer or exactly what changes
will be made. For this reason, I will cancel out of here and look at a different approach
to import the settings. The tool that I will use to do this is called
Security Configuration and Analysis. This is not available from the start menu so instead
I will need to run MMC from the start menu. Once MMC is started, the next step is to select
Add remove Snap in from the file menu. Once open I will add Security Configuration and
Analysis Snap in. This tool allows a small database of settings
to be created and compared with the current settings on the computer. The setting for
this database can be imported from the INF that I created on the first server.
To create a database, right click Security Configuration and Analysis and select the
option Open Database. The interface is a little different than what you may normally expect.
You could of course open and existing database if you had one created previously which in
this case I do not. However, if you do not have a database created and you enter in a
database name and select open, Security Configuration and Analysis will create the database for
you. This is a point often confusion when the tool is first used where an administrator
will often look for the new database option which does not exist.
The next dialog box will ask for a security template to import into the new database.
In this case I will select the security template that I saved to the desktop.
If you already have an existing database, new templates can be imported and they will
merge over the existing settings over writing an existing settings when there is a duplicate
found. Notice at the bottom there is a tick box, “Clear this database before importing.”
If you want to start a fresh with no settings in the database you can select this box. In
this case since the database is new and does not have any settings in it, it will not make
a difference if I tick this box or not. Now that the database has been created and
some settings imported into it, the next step is to compare these settings with the settings
currently configured on the local computer. To do this, I will right click on Security
Configuration and Analysis and select the option Analyze Computer Now.
I will prompted for a location for the log file which I will accept the default. I will
next expand down into Accounts Polices and then Password Policy. You will notice that
all the settings are listed with the current value and the one in the database. For example,
if I select Minimum Password Age that database settings is listed as 0 days and the current
setting or computer setting is also 0 days. If
I look at the other settings you will notice that
there are not any difference between the template and the local setting. You can start to see
how this tool can be used to tell what effect, if any, applying a security template to your
computer may have. When I select Security Options you will notice
that there are settings in here that have been configured. You can see this setting
has been enabled in the database and disabled in the local setting on this computer.
If I open the properties for this setting, I can see the title at the top that will give
me an indication what the setting does, but just like if I configured it using Group Policy
I can select the explain tab to get a lot more information about what the setting does.
If I go back to the settings, notice that there are other settings that have been configured
that are different from the local settings. If I open this setting, this setting will
display a message before the user logs into the computer. Notice that I can disable this
setting if I wish. When I go back, notice the setting has changed to Not Analyzed. This
is fine, this is basically saying that no setting exists. You can see that you can use
one server as a baseline for anther server. Before you apply the settings, you can make
any changes that you want. When you are ready to apply the setting, right
click Security Configuration and Analysis and select the option Configure Computer Now.
Once again I will be asked where to store the log file which I will accept the default
location. Security Configuration and Analysis can also
be run from the command line, if I open a command prompt the first parameter I will
look at is validate. Validate checks a security template for errors. To run this command all
you need to is add the filename and it will tell you if it found any problems with the
file. The next parameter I will look at is import.
This will import a security template into the database. To use this you need to add
the DB parameter and CFG parameter. These parameters indicate where the database is
located and also where the file for the security template is located. If you want to start
again with an empty database, add the OverWrite parameter. This will ensure the database is
empty before the import, otherwise the data will be merged with the existing data replacing
any existing data when there is a duplication. If you want to analysis the data in the database
what is configure on the local computer you can do this with the analyze parameter. All
you need to add is the DB parameter to indicate where the database is located. If you want
to review the results, you will need to use the graphical version of Security Configuration
and Analysis. If you want apply the settings stored in the
database to the local computer this can be done with the Configure parameter. Like the
Analysis parameter, all you need to add is the DB parameter to indicate where the database
is. There have been a lot of points covered in
this video so I will do a quick summary of the major points. Every Windows computer has
a local Group Policy. Inside this Group Policy is a number of settings that configure how
local security on the computer work. These allow you to configure settings like when
passwords will expire for user accounts created on that computer. The settings al define rights
that users will have, for example you could configure all users to have the right to backup
files if you so desired. Since a Domain Controller has the local users
account disabled and can only use Domain user accounts for additional security, the security
settings found in the local Group Policy on a Domain Controller do not have any effect
since no local user accounts are in use. For this reason, an additional Group Policy called
Default Domain Controller Policy is created when the Domain is created to ensure that
Domain Controllers have security settings applied that will work with Domain accounts.
Once you have the security settings part of Group Policy configured the way you want,
this can be exported to a INF file and imported into a Domain or Local Group Policy. Microsoft
also supply a Security Configuration and Analysis tool to compare the settings in the INF with
what is configured locally. In the next video I will look at the Security
Configuration Wizard. This tool allows the administrator to configure additional security
options like firewall rules and security for services. Thanks for watching and hope to
see you in the next video