Securing Windows 2000 Domain Controllers

On the domain controller, open a Web browser and go to the Securing Windows 2000 Server page of the Microsoft Download Center Web site at http://go.microsoft.com/fwlink/?LinkId=22720.

At the bottom of the page, under Files in This Download, click Securing_Windows_2000_Server.exe.

In the File Download dialog box, click Save.

When prompted for a location, expand the Save in list box, select Desktop, and then create a new folder in which to save the file by doing the following:

After the download is complete, in the Download complete box, click Close.

In the new folder on your desktop, double-click the Securing_Windows_2000_Server.exe file to open the WinZip Self-Extractor.

In the WinZip Self-Extractor dialog box:

In the set of extracted files and folders, double-click the Tools and Templates folder to open it, open the Security Guide folder, and then open the Security Templates folder.

In the Security Templates folder, right-click the MSS DCBaseline Role.inf file, and copy this file to the systemroot\Security\Templates folder of the domain controller on which you are performing these steps.

Click Start, click Settings, click Control Panel; double-click Administrative Tools, double-click Active Directory Users and Computers, and then click your domain to expand the domain tree.

Right-click the Domain Controllers OU, and then click Properties.

Note: Screenshots in this document reflect a test environment. The domain and server names in your environment might differ slightly from the ones shown in these screenshots.

In the Domain Controllers Properties dialog box, click the Group Policy tab, and then click New to create a new GPO.

Name the policy Domain Controllers Baseline Policy, and then click Close.

Right-click the Domain Controllers OU, and then click Properties.

In the Domain Controllers Properties dialog box, click the Group Policy tab, and then select the Domain Controllers Baseline Policy.

Click Up to move the new GPO to the top of the list, and then click Edit.

IMPORTANT: Be sure you are editing the newly created Domain Controllers Baseline Policy and not the Default Domain Controllers Policy. Incorrect modifications to the Default Domain Controllers Policy can adversely affect your environment and can be difficult to troubleshoot.

Under Computer Configuration, double-click the Windows Settings folder, right-click Security Settings, and then select Import Policy.

In the Import Policy From dialog box, select the MSS DCBaseline Role.inf file, and then click Open.

Close Group Policy, click OK to close the Domain Controllers Properties dialog box, and then exit Active Directory Users and Computers.

Restart your domain controllers one at a time. Do not reboot all of your domain controllers simultaneously because users might have difficulty logging on to the network or accessing network resources if no domain controller is available.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, and then double-click Event Viewer.

In Event Viewer, click Application Log and then look for the most recent event of:

If you double-click this event, you see an Event Properties window similar to the following:

Click OK, and then close Event Viewer.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, and then double-click Services.

Verify that the Alerter, Messenger, and Task Scheduler services are not running, and that their Startup Type is set to Disabled.

Note: The three services listed in step 2 are enabled by default in Windows 2000. These are not the only services disabled by the Domain Controllers Baseline Policy, but checking their configuration is a good indication that your new Group Policy settings have taken effect.

Close the Services tool.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, double-click Active Directory Users and Computers, and then click your domain to expand the domain tree.

Right-click the Domain Controllers OU, and then click Properties.

In the Domain Controllers Properties dialog box, click the Group Policy tab, click the Domain Controllers Baseline Policy, and then click Edit.

IMPORTANT: Be sure that you are editing the Domain Controllers Baseline Policy and not the Default Domain Controllers Policy. Incorrect modifications to the Default Domain Controllers Policy can adversely affect your environment and can be difficult to troubleshoot.

Under Computer Configuration, double-click the Windows Settings folder, double-click Security Settings, and then click System Services.

In the details pane (right pane), double-click DHCP Server, click Automatic, and then click OK.

Close the Group Policy Object Editor, click OK to close the properties dialog box, and then exit Active Directory Users and Computers.

Restart any domain controllers that provide DHCP services, being sure to restart them one at a time.

IMPORTANT: Do not reboot all your domain controllers simultaneously because users might have difficulty logging on to the network or accessing network resources if no domain controller is available.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, and then double-click Services.

Verify that the DHCP Server service is started and configured to run automatically.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, double-click Active Directory Users and Computers, and then click your domain to expand the domain tree.

Right-click the Domain Controllers OU, and then click Properties.

In the properties dialog box, click the Group Policy tab, click the Domain Controllers Baseline Policy, and then click Edit.

IMPORTANT: Be sure that you are editing the Domain Controllers Baseline Policy and not the Default Domain Controllers Policy. Incorrect modifications to the Default Domain Controllers Policy can adversely affect your environment and can be difficult to troubleshoot.

Under Computer Configuration, expand the Windows Settings folder, click Security Settings, and then click System Services.

In the details pane, double-click WINS, click Automatic, and then click OK.

Close the Group Policy Object Editor, click OK to close the properties dialog box, and then exit Active Directory Users and Computers.

Restart any domain controllers that provide WINS services, being sure to restart them one at a time.

IMPORTANT: Do not reboot all your domain controllers simultaneously because users might have difficulty logging on to the network or accessing network resources if no domain controller is available.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, and then double-click Services.

Verify that the Windows Internet Name Service (WINS) is started and configured to run automatically.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, double-click Active Directory Users and Computers, and then click your domain to expand the domain tree.

Right-click the Domain Controllers OU, and then click Properties.

In the properties dialog box, click the Group Policy tab, click the Domain Controllers Baseline Policy, and then click Edit.

IMPORTANT: Be sure you are editing the Domain Controllers Baseline Policy and not the Default Domain Controllers Policy. Incorrect modifications to the Default Domain Controllers Policy can adversely affect your environment and can be difficult to troubleshoot.

Under Computer Configuration, double-click the Windows Settings folder, double-click Security Settings, and then click System Services.

In the details pane, double-click Print Spooler, click Automatic, and then click OK.

Close Group Policy, click OK to close the properties dialog box, and then exit Active Directory Users and Computers.

Restart any domain controllers that provide Print services, being sure to restart them one at a time.

IMPORTANT: Do not reboot all your domain controllers simultaneously because users might have difficulty logging on to the network or accessing network resources if no domain controller is available.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, and then double-click Services.

Verify the Print Spooler service is started and configured to run automatically.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, double-click Active Directory Users and Computers, and then double-click your domain to expand the domain tree.

Right-click the Domain Controllers OU, and then click Properties.

In the properties dialog box, click the Group Policy tab, click the Domain Controllers Baseline Policy, and then click Edit.

Important: Be sure that you are editing the Domain Controllers Baseline Policy and not the Default Domain Controllers Policy. Incorrect modifications to the Default Domain Controllers Policy can adversely affect your environment and can be difficult to troubleshoot.

Under Computer Configuration, double-click the Windows Settings folder, double-click Security Settings, and then click System Services.

In the details pane (right pane), double-click IAS, click Automatic, and then click OK.

Close the Group Policy Object Editor, click OK to close the properties dialog box, and then exit Active Directory Users and Computers.

Restart any domain controllers that use ISA, being sure to restart them one at a time.

IMPORTANT: Do not restart all your domain controllers simultaneously because users might have difficulty logging on to the network or accessing network resources if no domain controller is available.

Click Start, click Control Panel, click Settings, double-click Administrative Tools, and then double-click Services.

Verify that the IAS service is running and configured to start automatically.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, double-click Active Directory Users and Computers, and then double-click your domain to expand the domain tree.

Right-click the Domain Controllers OU, and then click Properties.

In the properties dialog box, click the Group Policy tab, click the Domain Controllers Baseline Policy, and then click Edit.

IMPORTANT: Be sure that you are editing the Domain Controllers Baseline Policy and not the Default Domain Controllers Policy. Incorrect modifications to the Default Domain Controllers Policy can adversely affect your environment and can be difficult to troubleshoot.

Under Computer Configuration, double-click the Windows Settings folder, double-click Security Settings, and then click System Services.

In the details pane, double-click CertSvc, click Automatic, and then click OK.

Close the Group Policy Object Editor, click OK to close the properties dialog box, and then exit Active Directory Users and Computers.

Restart your domain controllers one at a time.

IMPORTANT: Do not restart all your domain controllers simultaneously because users might have difficulty logging on to the network or accessing network resources if no domain controller is available.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, and then double-click Services.

Verify that Certificate Services is running and configured to start automatically.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, double-click Active Directory Users and Computers, and then double-click your domain to expand the domain tree.

Right-click the Domain Controllers OU, and then click Properties.

In the properties dialog box, click the Group Policy tab, click the Domain Controllers Baseline Policy, and then click Edit.

IMPORTANT: Be sure you are editing the Domain Controllers Baseline Policy and not the Default Domain Controllers Policy. Incorrect modifications to the Default Domain Controllers Policy can adversely affect your environment and can be difficult to troubleshoot.

Under Computer Configuration, double-click the Windows Settings folder, double-click Security Settings, and then click System Services.

In the details pane, double-click Task Scheduler, click Automatic, and then click OK.

Close the Group Policy Object Editor, click OK to close the properties dialog box, and then exit Active Directory Users and Computers.

Restart any domain controllers that use the Task Scheduler, being sure to restart them one at a time.

IMPORTANT: Do not reboot all your domain controllers simultaneously because users might have difficulty logging on to the network or accessing network resources if no domain controller is available.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, and then double-click Services.

Verify that the Task Scheduler service is running and is configured to start automatically.

Click Start, click Settings, click Control Panel, and then double-click Scheduled Tasks.

From the Advanced menu, select AT Service Account.

Click the This Account option, type the name and password for an account that does not provide administrative privileges to your domain controller, and then click OK.

IMPORTANT: Be sure that the account you use does not belong to any of the administrative groups (for example, Enterprise Admins, Domain Admins, or Administrators). It is recommended that you create a specific service account for this purpose and periodically monitor the account's group membership.

If you need to run a task that uses administrator credentials, you must schedule the task by using the Add Scheduled Tasks wizard in Task Scheduler.

Click Start, click Settings, click Control Panel, double-click Administrative Tools, and then double-click Automatic Updates.

Select the check box labeled Keep my Computer up-to-date. With this setting enabled, Windows Update software may be automatically updated prior to applying any other updates.

Select the option Automatically download the updates, and install them on the schedule that I specify.

Select the day and time for the updates to occur, and then click OK to close the Automatic Updates window.

IMPORTANT: Security updates often require that your domain controllers be restarted. Choose a day and time that minimizes the impact to your users.

Click Start, click Programs, and then click Windows Update.

In Internet Explorer, click Scan for Updates, and then wait until the scan is 100% complete.

Windows Update will automatically select any necessary critical security updates missing from your domain controller. If any updates are available, click Review and Install Updates, click Install Now, and then follow the installation instructions on your screen.

Repeat these steps until no critical updates are available for your domain controller.