1001 Secrets for Windows NT Registry
(Publisher: 29th Street Press)
Author(s): Tim Daniels
ISBN: 1882419685
Publication Date: 12/01/97

Previous Table of Contents Next


Print Driver Installation

V-27 Hive: HKEY_LOCAL_MACHINE
Key: System\CurrentControlSet\Control\Print\Providers\ LanMan Print Services
Value Name: AddPrinterDrivers
Data Type: Dword
Value: 1

This value prevents users from adding printers on the local machine. It does not prevent additions from the network.

Removable Media

V-28 This registry entry restricts access to the floppy disk drives on a system to only those users who are logged on interactively.

Hive: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ Winlogon

Add the following value under the WinLogon key:

Value Name: AllocateFloppies
Data Type: REG_SZ
Value: 1

V-29 You can restrict the CD-ROMs as well.

Hive: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ Winlogon

Add the following value under the WinLogon key:

Value Name: AllocateCDRoms
Data Type: REG_SZ
Value: 1

If either of these registry entries doesn’t exist or is set to a value other than 1, all floppy and CD-ROM devices are available for shared use to all processes on the system.

Auditing Base System Objects

V-30 If you need to audit the base system objects on your Windows NT Server or Workstation, add the following registry value.

Hive: HKEY_LOCAL_MACHINE
Key: System\CurrentControlSet\Control\Lsa:

Add the following value under the Lsa key:

Value Name: AuditBaseObjects
Data Type: REG_DWORD
Value: 1

You need to turn on auditing in User Manager for the “Object Access” category to actually begin auditing.

Full Privilege Auditing

V-31 Not all privileges are audited by Windows NT by default. Modifying this registry entry lets you audit these additional privileges.

Hive: HKEY_LOCAL_MACHINE
Key: System\CurrentControlSet\Control\Lsa:

Add the following value under the Lsa key:

Value Name: FullPrivilegeAuditing
Data Type: REG_BINARY
Value: 1

The additional privileges audited are bypass traverse checking, debug programs, create a token object, replace process level token, generate security audits, back up files and directories, and restore files and directories.

Shutdown on Full Audit Log

V-32 If you monitor your logs closely, you may want to enable this feature. When the security log is full, Windows NT shuts down. The registry value is then set to 2, and when the system reboots, only administrators can log on. The administrator must clean out the log, reset the value to 1, and reboot the system before users can log on.

Hive: HKEY_LOCAL_MACHINE
Key: System\CurrentControlSet\Control\Lsa:

Add the following value under the Lsa key:

Value Name: CrashOnAuditFail
Data Type: REG_DWORD
Value: 1


Previous Table of Contents Next