Previous | Table of Contents | Next |
V-27 | Hive: | HKEY_LOCAL_MACHINE |
Key: | System\CurrentControlSet\Control\Print\Providers\ LanMan Print Services | |
Value Name: | AddPrinterDrivers | |
Data Type: | Dword | |
Value: | 1 |
This value prevents users from adding printers on the local machine. It does not prevent additions from the network.
V-28 This registry entry restricts access to the floppy disk drives on a system to only those users who are logged on interactively.
Hive: | HKEY_LOCAL_MACHINE |
Key: | SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ Winlogon |
Add the following value under the WinLogon key:
Value Name: | AllocateFloppies | |
Data Type: | REG_SZ | |
Value: | 1 |
V-29 You can restrict the CD-ROMs as well.
Hive: | HKEY_LOCAL_MACHINE |
Key: | SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ Winlogon |
Add the following value under the WinLogon key:
Value Name: | AllocateCDRoms | |
Data Type: | REG_SZ | |
Value: | 1 |
If either of these registry entries doesnt exist or is set to a value other than 1, all floppy and CD-ROM devices are available for shared use to all processes on the system.
V-30 If you need to audit the base system objects on your Windows NT Server or Workstation, add the following registry value.
Hive: | HKEY_LOCAL_MACHINE |
Key: | System\CurrentControlSet\Control\Lsa: |
Add the following value under the Lsa key:
Value Name: | AuditBaseObjects | |
Data Type: | REG_DWORD | |
Value: | 1 |
You need to turn on auditing in User Manager for the Object Access category to actually begin auditing.
V-31 Not all privileges are audited by Windows NT by default. Modifying this registry entry lets you audit these additional privileges.
Hive: | HKEY_LOCAL_MACHINE |
Key: | System\CurrentControlSet\Control\Lsa: |
Add the following value under the Lsa key:
Value Name: | FullPrivilegeAuditing | |
Data Type: | REG_BINARY | |
Value: | 1 |
The additional privileges audited are bypass traverse checking, debug programs, create a token object, replace process level token, generate security audits, back up files and directories, and restore files and directories.
V-32 If you monitor your logs closely, you may want to enable this feature. When the security log is full, Windows NT shuts down. The registry value is then set to 2, and when the system reboots, only administrators can log on. The administrator must clean out the log, reset the value to 1, and reboot the system before users can log on.
Hive: | HKEY_LOCAL_MACHINE |
Key: | System\CurrentControlSet\Control\Lsa: |
Add the following value under the Lsa key:
Value Name: | CrashOnAuditFail | |
Data Type: | REG_DWORD | |
Value: | 1 |
Previous | Table of Contents | Next |