what are the best things to do to secure win 2003

[APOC9109]

If someone would give me an order of importance what would it be.

I mean i have heard i should change all default accounts like administrater etc to a different name
this way passord cracking programs do not have have the pie (the user name)? is this used by real administratos.

sp1 has the security config anaylisis tool, is this a useful tool that Real administrators use?

I am trying hard to implement 2k3 ca server, is this coomom practice to ise with ssl, efs, email or am I wasting my time?


closing unused ports or ports with high vulnerability


using run as

default domain security policy

the use of IPsec with L2tp


Can yiou use ssl without a CA, if so whcih method is preffered?

 

[ScottCr]

Don't change the name of the admin account. Disable it. Even if you change the name the RID is still the same, so would take about 60 seconds to find out the new name.

Have a look here.

http://scottcross.blogspot.com/2006/03/windows-2003-anonymous-connections.html

http://scottcross.blogspot.com

Windows and NT Admin.

 

[58sniper]

Actually, I would rename and then disable it. It's possible, as ScottCr mentioned, to find out the RID of the renamed account, but that's an extra step. There is not a single thing you can do to make your network absolutely totally secure. It's a bunch of things. Do them all.

CA is useful for things like OWA, Outlook over HTTPS, etc.

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)

 

[ScottCr]

Good Idea, I agree that renaming and then disabling is better idea. But of course the RID won't change if you rename an account.

Along the same line, I wouldn't have a shared admin account. Anyone who needs admin access should have their own account, otherwise any auditing you implement will be worthless.

http://scottcross.blogspot.com

Windows and NT Admin.

 

[58sniper]

I don't like granting admin rights to "standard" user accounts because of security (mostly spyware and virus) concerns. I would create something like a "BackupAdmin", "ExchangeAdmin", "SQLAdmin", and delegate appropriately. This, of course, is assuming that there is a single person for each of these roles. Have them use the respective admin accounts to perform admin functions, but have them use their "standard" account for everything else (e-mail, surfing, etc.). Just my opinion, of course.

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)

 

[ScottCr]

Actually this might be useful:

http://scottcross.blogspot.com/2006/03/10-easy-ways-to-lock-down-your-pc.html

and this:

http://scottcross.blogspot.com/2006/03/access-based-enumeration-in-windows.html

http://scottcross.blogspot.com

Windows and NT Admin.

 

[Seaspray0]

If you plan on using https, you will need a certificate. You can use a CA to generate your own certificate or purchase one from a trusted internet CA. The difference... if you use your own CA, then only those computers that you give a computer certificate to will be able to do https with your server; if you use a trusted internet CA then everyone will be able to do https with your server. If you plan on having https web pages that are available to everyone on the internet, then you will need the purchased certificate.

Start, Help. You'll be surprised what's there. A+/MCP/MCSE/MCDBA