| Issue |
Fix |
| Clear Last Login from console |
HKEY_LOCAL_MACHINE\SOFTWARE
\Microsoft\WindowsNT\CurrentVersion\WinLogin
Add Value: DontDisplayLastUserName
-DataType: REG_SZ
-String: 1 |
| Add Legal Notice |
HKEY_LOCAL_MACHINE\SOFTWARE
\Microsoft\WindowsNT\CurrentVersion\WinLogin
Select: LegalNoticeCation and add appropriate text
Select: LegalNoticeText and add appropriate text
|
| Disable NTFS 8.3 naming |
HKEY_LOCAL_MACHINE\SYSTEM
\CurrentControlSet\Control\FileSystem
Select: NtfsDsiable8dot3NameCreation
Select: REG_DWORD
-String: 1
|
| Disable OS/2 & POSIX |
HKEY_LOCAL_MACHINE\SOFTWARE
\MicroSoft\OS/2 Subsystem for NT
Delete: all sub keys
HKEY_LOCAL_MACHINE\SYSTEM
\CurrentControlSet\Control\SessionManager\Environment
Delete: Os2LibPath
HKEY_LOCAL_MACHINE\SYSTEM
\CurrentControlSet\Control\Session Manager\SubSystems
Delete: Optional
HKEY_LOCAL_MACHINE\SYSTEM
\CurrentControlSet\Control\Session Manager\SubSystems
Delete entries for Posix and OS/2
Delete: os2.exe, os2srv.exe, os2ss.exe, posix.exe, psxss.exe (\winnt\system32\os2\?)
|
| Remove Administrative Shares |
HKEY_LOCAL_MACHINE\SYSTEM
\CurrentControlSet\Services\LanmanServer\Parameters
Add Value: AutoShareServer
-REG_DWORD
-Value: 0
|
| Restrict NULL (Anonymous) sessions |
HKEY_LOCAL_MACHINE\SYSTEM
\CurrentControlSet\Control\LSA
Add Value: RestrictAnonymous
-REG_DWORD
-Value: 1
|
| Protect Critical Registry Keys |
The following keys should be protected using
the following permissions:
- Administrators (Full Control)
- SYSTEM (Full Control)
- Creator Owner (Full Owner)
- Everyone (Read Only)
HKEY_LOCAL_MACHINE\SOFTWARE
Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE
Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE
Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\SOFTWARE
Microsoft\Windows NT\CurrentVersion\AeDebug
HKEY_LOCAL_MACHINE\SOFTWARE
Microsoft\Windows NT\CurrentVersion\WinLogon
HKEY_LOCAL_MACHINE\Software
Microsoft\Windows\Current\Version\Uninstall
|
| Remove FPNWCLNT trojan bug (if not using FPNW) |
HKEY_LOCAL_MACHINE\SYSTEM
CurrentControlSet\Control\Lsa
Select: Notification Packages
Delete: FPNWCLNT (only!)
|
| Protect Printer Drivers |
HKEY_LOCAL_MACHINE\SYSTEM
CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers
Add: AddPrintDrivers
-REG_DWORD
-Value:1 |
| Disable CD-ROM Autorun |
HKEY_LOCAL_MACHINE\SYSTEM
CurrentControlSet\Services\Cdrom
Select: Autorun
-REG_DWORD
-Value:0 |
| Limit floppy usage to console user |
HKEY_LOCAL_MACHINE\SOFTWARE
Microsoft\WindowsNT\CurrentVersion\Winlogon
Add: AllocateFloppies
-REG_SZ
-Value:1
|
REPORTS
ANALYTICS
Follow 
