Содержимое файла шаблона безопасности

; Copyright (c) Microsoft Corporation. All rights reserved.

;

; Security Configuration Template for Security Configuration Editor

;

; Template Name: SecureDC.INF

; Template Version: 05.10.SD.0000

[Profile Description]

%SCESecureDCProfileDescription%

[version]

signature=" $CHICAGO$"

revision=1

DriverVer=10/01/2002, 5.2.3790.3959

[System Access]

; ----------------------------------------------------------------

; Account Policies - Password Policy

; ----------------------------------------------------------------

MinimumPasswordAge = 2

MaximumPasswordAge = 42

MinimumPasswordLength = 8

PasswordComplexity = 1

PasswordHistorySize = 24

ClearTextPassword = 0

LSAAnonymousNameLookup = 0

EnableGuestAccount = 0

; ----------------------------------------------------------------

; Account Policies - Lockout Policy

; ----------------------------------------------------------------

LockoutBadCount = 5

ResetLockoutCount = 30

LockoutDuration = 30

; ----------------------------------------------------------------

; Local Policies - Security Options

; ----------------------------------------------------------------

; DC Only

ForceLogoffWhenHourExpire = 1

; NewAdministatorName =

; NewGuestName =

; SecureSystemPartition

; ----------------------------------------------------------------

; Event Log - Log Settings

; ----------------------------------------------------------------

; Audit Log Retention Period:

; 0 = Overwrite Events As Needed

; 1 = Overwrite Events As Specified by Retention Days Entry

; 2 = Never Overwrite Events (Clear Log Manually)

[System Log]

RestrictGuestAccess = 1

[Security Log]

AuditLogRetentionPeriod = 0

RestrictGuestAccess = 1

[Application Log]

RestrictGuestAccess = 1

; ----------------------------------------------------------------------

; Local Policies\Audit Policy

; ----------------------------------------------------------------------

[Event Audit]

AuditSystemEvents = 0

AuditObjectAccess = 0

AuditPrivilegeUse = 2

AuditPolicyChange = 3

AuditAccountManage = 3

AuditProcessTracking = 0

AuditDSAccess=2

AuditLogonEvents = 3

AuditAccountLogon=3

; ----------------------------------------------------------------------

; Local Policies\SecurityOptions

; ----------------------------------------------------------------------

[Registry Values]

; Registry value name in full path = Type, Value

; REG_SZ (1)

; REG_EXPAND_SZ (2) // with environment variables to expand

; REG_BINARY (3)

; REG_DWORD (4)

; REG_MULTI_SZ (7)

MACHINE\System\CurrentControlSet\Control\Lsa\AuditBaseObjects=4, 0

MACHINE\System\CurrentControlSet\Control\Lsa\CrashOnAuditFail=4, 0

MACHINE\System\CurrentControlSet\Control\Lsa\DisableDomainCreds=4, 0

MACHINE\System\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymous=4, 0

; ForceGuest is not acknowledged on DC's:

; MACHINE\System\CurrentControlSet\Control\Lsa\ForceGuest=4, 0

MACHINE\System\CurrentControlSet\Control\Lsa\FullPrivilegeAuditing=3, 0

MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel=4, 4

MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinClientSec=4, 0

MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinServerSec=4, 0

MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash=4, 1

MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous=4, 1

MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM=4, 1

MACHINE\System\CurrentControlSet\Control\Lsa\SubmitControl=4, 0

MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4, 1

MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel\ObCaseInsensitive=4, 1

MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown=4, 0

MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode=4, 1

MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4, 1

MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4, 0

MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableForcedLogOff=4, 1

MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\AutoDisconnect=4, 15

MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess=4, 1

MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature=4, 1

MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature=4, 0

MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword=4, 0

MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity=4, 1

MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerIntegrity=4, 1

MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange=4, 0

MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\MaximumPasswordAge=4, 30

MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange=4, 0

MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SignSecureChannel=4, 1

MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SealSecureChannel=4, 1

MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireSignOrSeal=4, 0

MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireStrongKey=4, 0

MACHINE\Software\Microsoft\Driver Signing\Policy=3, 2

MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4, 0

MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName=4, 0

MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption=1, " "

MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText=7, " "

MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon=4, 0

MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UndockWithoutLogon=4, 0

MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=4, 0

MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand=4, 0

MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateCDRoms=1, 1

MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateDASD=1, 0

MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateFloppies=1, 1

MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount=1, 10

MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceUnlockLogon=4, 1

MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4, 14

MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption=1, 2

[Strings]

SceInfAdministrator = " Администратор"

SceInfAdmins = " Администраторы"

SceInfAcountOp = " Операторы учета"

SceInfAuthUsers = " Прошедшие проверку"

SceInfBackupOp = " Операторы архива"

SceInfDomainAdmins = " Администраторы домена"

SceInfDomainGuests = " Гости домена"

SceInfDomainUsers = " Пользователи домена"

SceInfEveryone = " Все"

SceInfGuests = " Гости"

SceInfGuest = " Гость"

SceInfPowerUsers = " Опытные пользователи"

SceInfPrintOp = " Операторы печати"

SceInfReplicator = " Репликатор"

SceInfServerOp = " Операторы сервера"

SceInfUsers = " Пользователи"

SceInfProgramFiles = " Program Files"

SceSecureDCProfileDescription = " Предоставляет расширенные политики для управления учетными записями в домене, ограничивает использование проверки подлинности LanManager, накладывает дальнейшие ограничения для анонимных пользователей. Если контроллер домена использует securedc, то пользователь с учетной записью в этом домене не сможет подключаться к рядовым серверам только с помощью клиента LanMan. Дальнейшие сведения содержатся в справке."