109
7.
Force replication between the domain controllers so that all have the policy applied to them by
doing the following:
a.
Open a command prompt, and use the
gpupdate.exe
command line tool to force the
server to refresh the policy with the command:
gpupdate /Force.
For Windows 2000 Active Directory domains:
Administrators should use the
secedit.exe/refreshpolicy
command-line from the DOS prompt instead to force domain
policy replication.
b.
Reboot server for changes in the registry and services.
8.
Verify in the Event Log that the Group Policy downloaded successfully and that the server can
communicate with the other domain controllers in the domain.
2.8.7.2
Securing Well Known Accounts
Windows Server 2003 has a number of built-in user accounts that cannot be deleted but can be
renamed. Two of the most well known built-in accounts in Windows 2003 are Guest and
Administrator. By default, the Guest account is disabled on member servers and domain controllers.
This setting should not be changed. The built-in Administrator account is renamed and the description
altered to help prevent attackers from compromising a remote server by using a well known account.
Many variations of malicious code use the built-in administrator account in an initial attempt to
compromise a server. The value of this configuration change has diminished over the past few years
since the release of attack tools that attempt to break into the server by specifying the SID of the built-
in Administrator account to determine its true name. A SID is the value that uniquely identifies each
user, group, computer account, and logon session on a network. It is not possible to change the SID
of this built-in account. Renaming the local administrator account to a unique name can make it easy
for the domain operations groups to monitor attempted attacks against this account.
Complete the following steps to secure well known accounts on domains and servers:
1.
Rename the Administrator and Guest accounts, and change their passwords to a long and
complex value on every domain and server.
2.
Use different names and passwords on each server. If the same account names and passwords
are used on all domains and servers, an attacker who gains access to one member server will be
able to gain access to all others with the same account name and password.
3.
Change the account descriptions to something other than the defaults to help prevent easy
identification of the accounts.
4.
Record these changes in a secure location.
Note:
The built-in administrator account can be renamed via Group Policy. This setting was not
implemented in the DCBP because administrators should choose a unique name for their environment.
The
Accounts: Rename administrator account
can be configured to rename administrator accounts in
the three environments defined in this guide. This setting is a part of the Security Options settings of a
GPO.
2.8.7.3
Securing Service Accounts
Never configure a service to run under the security context of a domain account unless absolutely
necessary. If the server is physically compromised, domain account passwords can be easily obtain
by dumping LSA secrets.
