| Figure C |
 |
| The password policy for the NT system in my lab |
Since this testing system running NT is a new installation, it makes sense that many of the security options that are in place on my production systems are not yet mimicked here. What I need is a quick, easy way to set this information so that I don't have to try to find every single parameter and set it to a reasonable value. Luckily, the SCM comes with a number of preconfigured security templates. As an example, let's say that I want to tightly secure this system by setting a strict password policy, auditing login successes and failures, and setting AutoDisconnect parameters -- while keeping in mind that this system is also a domain controller. One of the stock security templates, hisecdc4, can take care of this. Looking through the parameters, you can see that hisecdc4 sets a password policy requiring a minimum of eight characters with a password age of 42 days and prohibiting duplication of the six most recent passwords. In addition, hisecdc4 audits all login failures and sets an AutoDisconnect time of 15 minutes for idle sessions. One parameter it does not include but that I would like to add is the auditing of logon successes. This can be easily rectified by browsing to the hisecdc4 security template and choosing Local Policies | Audit Policy. This will bring up all of the policies related to system auditing. One of these policies is named Audit Logon Events. Opening this policy shows that only failures are audited. To enable auditing of logon successes, all I have to do is select the appropriate check box (Figure D) and click OK.
| Figure D |
 |
| Enabling logon success auditing |
| Figure E |
 |
| The logon audit parameter is now set on this system. |
If you haven't had the opportunity to make use of this tool, there's no better time than the present. If you need to configure multiple similar NT servers, you can even reuse your custom security templates to make hardening your servers a breeze. While it's not a new utility, the SCM is invaluable for helping you secure and protect your Windows NT infrastructure.
For a weekly round-up of the enterprise IT news, sign up for the
Enterpise newsletter. Find out what's where in the new Tech Update with our
Guided Tour. Tell us what you think in the
Enterprise Mailroom.
Enterpise newsletter. Find out what's where in the new Tech Update with our
Guided Tour. Tell us what you think in the
Enterprise Mailroom.
