In this video from ITFreeTraining I will look at the Security Configuration Wizard. The
Security Configuration Wizard allows you to tighten security up on your servers which
helps prevent them from being access by unauthorized users.
Before I start looking at Security Configuration Wizard and how it can help you keep your server
secure in your company, I will first look at the concept of attack surface. This will
help you understand why tightening security on your servers using tools like Security
Configuration Wizard is so important. The attack surface is software, protocols
and ports that an attacker could potentially exploit in order to gain control of your server.
If you take a typical server, the server has services, software and protocols that make
it work. Depending on what you require the server to do, there is potentially extra software,
Protocols and Ports that are not required and could be used to comprise your server
by an attacker. There may not be a vulnerability that can be used to exploit the server today,
but tomorrow there could be. This is why it is important that anything that is not required
is removed or disabled. In some cases you may not be able to remove
or disable a particular item. For example, let’s say a protocol is required by a server
to allow old clients to connect. In this case you could not disable this protocol until
all the old clients have been removed from the network. However, another option may be
to increase the security of that protocol. Perhaps bigger encryption keys could be used
or there may be an option to encapsulate the protocol in a more secure protocol.
Lastly the firewall on the server should be enabled and configured with rules that prevent
unwanted traffic. For example, if you do not require the time service on the server, this
should be blocked on the firewall. You can see that by reducing the attack surface on
a server greatly reduced the chance of a hacker being able to access your server now and when
a new vulnerability is found tomorrow. This video will look at how you can reduce
the attack surface of your server using Security Configuration Wizard . The process of making
your computers more secure is also referred to as hardening. Without further to do, I
change to a server on my DMZ and look at how to use the Security Configuration Wizard.
I have chosen this server as it is accessible on the internet and thus at high risk of attack.
First of all, I will open Security Configuration Wizard from Administrative Tools under the
start menu. On the welcome screen of the wizard notice that there is a warning message telling
me that the wizard can only detect open ports if the software that is using these ports
in running. Before you run the wizard, you should ensure that any software on the server
is running, this way the wizard can correctly read any settings that it may require.
On the next screen of the wizard, you need to select if you are creating a new security
policy, editing an existing one, apply a security policy or rolling back a previously applied
security policy. In this case I do not have a security policy configured so I will choose
the top option, create a new security policy. On the next screen is the welcome screen for
role based service configuration. The wizard itself is divided into a number of different
sections like this one to make it easier to work out which settings you are configuring.
The next screen shows you which roles are currently configured on the server. If you
are planning on adding a role later on you should tick the role. For example, later on
I will be adding the file server role so I will tick it here. If your needs change later
on, you can always rerun the wizard and make the required changes so do not be concerned
if you do not know at this stage which roles may be installed later on.
On the next screen you can decide which features you want to use. Following this screen you
can also select which options you want to configure. Options are very small features
in the operating system and thus do not fit into the feature or roles category.
On the next screen you can select which additional services that you want to allow or disable.
These are services that are not associated with a role or feature or installed by 3rd
party software. On the next screen you can decide what to
do with services that were not defined on the previous screen. In other words, an unexpected
service not covered by the previous options. By default, the option, “Do not change the
startup mode of the service” is selected. If you have 3rd party software that installed
a service on the server this will allow it to continue to run after the Security Configuration
Wizard has applied a policy. In this case I want to make sure services
that I do not know about are disabled, so I will select the option disable the service.
If I find that later on I need a service that was disabled, I can simply re-enable it.
The next screen shows you the changes to the services that will be made. You can see that
services like the audio service has been disabled. On this server there is no need for audio
so this is a good choice of service to stop. If you want to make sure your server is as
secure as possible, you should disable services like these that will never be used. Having
extra services provides additional software on the server that a hacker may be able to
take advantage of in order to gain access to your server.
This is the end of service section, the next part of the wizard deals with network settings.
Once past the welcome screen, the next screen will ask about firewall rules. You should
disable rules that you do not require. For example, this server will have a static IP
address and will not have the DHCP role installed on it. For this reason I will untick the rules
for DHCP. If you need a very secure server, you should go through and untick anything
that you do not need. For example, if you are never planning on using IPv6 on the server
you should untick it. Any additional rules that you leave enabled potentially could be
used to take advantage of a vulnerability on the server.
The next section is the registry section. These settings make changes to the registry
to increase security or decrease security. Each section has a tick box to skip that section
if you do not want to configure it. This is very useful if you want to make a small change
later and do not want to go through all the prompts again.
On the next screen, you can configure security settings related to SMB. SMB is used in file
sharing. The default option will increase security but will do it by not allowing old
clients to connect and puts some extra load on the CPU. Unless you need to, it is best
to leave these two options ticked. The next screen determines which authentication
will be used with LAN Manager by the server to the remote computer. You will only need
to configure options here if you are using old clients.
The next screen applies to inbound LAN authentication methods. The two options are LAN Manager and
NTLM version 2. LAN Manager is an old version of file sharing so if you do not have any
old clients that use it, you may as well disable it.
The next screen allows you to review the registry settings before they are applied. This helps
you understand what changes will be made from what you have currently configured.
The next section is the audit policy. Auditing allows an event to be generated when certain
events happen on the system. This allows you to determine who is using the system and also
who is attempting to use the system and getting denied. Later in the course I will be covering
auditing in more detail. The next screen allows you to determine when
events should be generated. Auditing does put extra load on your system so if you do
not need it, it is best to select the option do not audit. In this case since I want to
determine if someone is attempting to access the server without authorization I will select
the option to audit successful and unsuccessful events on the server.
The next screen allows you to review what settings will be changed. Notice also the
tickbox at the bottom, “Also include the SCWAudit.INF security template.” This is
special template that changes some permissions in the operating system making it more secure.
It should be noted here that since it is effectively applying a security template to local Group
Policy, this can be rolled back later on using the roll back feature. If you want to reverse
these settings, you will need to change the settings yourself or apply a different security
template to change the settings. Security templates were covered in the last video if
you want to know how to do this. Once I press next, the next screen tells me
all the settings that have been configured and now the settings are ready to be saved.
On the next screen I need to decide where to save the file to and what directory. In
this case, I will save the file to a network location so that I can access it on anther
server. Notice that I also have the option to include
a security template if I wish to use configuration from a previous created security template.
This effectively provides a bridge between the newer Security Configuration Wizard and
the older security templates allowing you to use any old security templates that you
may have. Now that I have configured and saved my settings,
I will now change to my second server to apply the settings.
All though I should apply the settings on the first server since I want to secure it
as well, I will apply them to this server first to demonstrate how easy it is to apply
the settings on different servers. Just like on the last server, I will open
the Security Configuration Wizard from Administrative tools under the start menu.
Once I am past the welcome screen, I will select the option “Apply an existing security
policy”. Once I browse to the setting security policy all I need to do is press next. The
next screen will ask me which server I want to apply the setting to. In this case, I will
be applying the setting to the local server. You can apply the settings to a remote server
however it is possible for the new security settings that you apply from remote will prevent
you accessing the server. For this reason, I prefer to apply the settings from the local
server rather than from remote unless I completely sure it will not prevent me accessing the
server afterwards. If you do decide to apply the settings to a remote server, ensure that
you have console access to the server in case you cannot access the server from remote afterwards.
On the next screen, you have the option to select view security policy if you want to
view what the settings will be before you apply them.
If you are happy with the settings, press next and they will applied. In some cases
you may want to roll back the changes if you find that they have done more harm than good.
If this occurs you can reverse the process otherwise known as roll back and return back
to the original settings. Once the settings have been applied, I will close the wizard
and then open it again. Once I am past the welcome screen, this time
I will select the option rollback the last applied security policy. Once again I will
need to enter in the server that I want to roll back the changes to, in this case it
will be the local server. On the next screen, you can view the rollback
file to see what settings will be applied. The rollback will be started when I press
next. This is one way you can apply the security
settings configured using the Security Configuration Wizard. However, if you are using computers
that are in the domain you will most likely want to use Group Policy to deploy these settings.
To do this, I will change to one of my Domain Controller in the New York site.
In order to create a GPO from the setting that I have already created, this will need
to be done from the command prompt. Once I open a command prompt, I will use the command
SCWCMD. The first parameter I need to add is transform
to indicate I want to convert the security policy to anther format. I could also perform
other actions that I would normally perform in the wizard like applying a security policy
and rolling back a security policy if I wanted to.
The next parameter is /P. This indicates the security Policy I want to use. To do this,
add a colon and then the file name. Next you need to use the /g parameter to indicate the
Group Policy Object that I want to create. Once again, I need to add a colon followed
by the name. The command itself does not take too long
to run. Once complete, I will next open Group Policy Management from the start menu. If
I open Group Policy Objects, I can see the new Group Policy that I created.
The GPO has not been linked as yet to any OU’s and thus will not have any effect on
any computers in the domain. In this case, I will link it to the OU testing. With all
the potential changes that this Group Policy could make, I would highly recommend testing
it first before you deploy it on any production computers.
In the real world, it is easy to tighten up security on all your servers but high security
does come at a price. When managing your servers, identify high risk servers. Servers that are
accessible on the internet fit into this category. Consider is the extra security worth the extra
cost. Tighten up the security on a server and accidently denying access to all your
users preventing them doing their jobs costs the company money and productivity. Extra
security will often create more helpdesk calls when systems no longer work as expected.
When consider how to secure your servers it is often a matter of finding a balance between
cost and security. If you are not sure which settings to change, start with only a few
settings. If they are no problems you can increase the number of settings. If there
are problems you have the ability to quickly revert the setting back until you can work
out what when wrong. In this video I have looked at The Security
Configuration Wizard. A great wizard for improving the security on your servers. This is only
one video in the free Active Directory course. Thanks for watching and see you in the next video.