Using the Security Configuration Wizard to Harden Your Windows Servers

Q: I'm looking for an easy way to harden the security settings of my Windows file servers. What tool would you recommend I use?

A: I recommend using the Security Configuration Wizard (SCW), which Microsoft first included in Windows Server 2003 SP1. The SCW guides administrators through the process of configuring, editing, applying, and rolling back security policies on Windows servers. SCW security policies can be enforced using the SCW or Windows Group Policy Object (GPO) settings.

The SCW is role-based and can generate XML-formatted security policy files that are tailored to a server’s specific role. Sample roles include a file server, a Microsoft Exchange front-end server, and a print server. You can use the SCW to create a security policy for a particular server role on one server, and then automatically apply it to all the servers that have the same role in your organization.

The SCW uses an extensible knowledge base that contains a list of preferred security settings for different Windows server roles, and it reduces the time needed to create a baseline security policy for a particular server type. Instead of reading several hardening guidance documents, you can leverage the SCW’s built-in knowledge base.

You can also use the SCW to configure several security-related server configuration settings such as enabled or disabled services and their inbound or outbound network connectivity, security-related registry settings (e.g., Server Message Block—SMB—signing and LAN Manager authentication levels), and the audit policy. In addition, the SCW can lock down the network ports on a Windows system. Network ports that typically would have been open and thus listening for incoming requests are effectively shut down, thwarting potential security breaches. In Windows 2003, the SCW is also an important tool for reducing the attack surface of a Windows server.

To apply SCW security policies in Windows domain environments, I recommend transforming the SCW policy into GPO settings and applying the security policies through the GPO. Doing so will enable you to apply the SCW policy to multiple servers at one time. It's a less time-consuming solution for applying security policies than having to run the SCW on each individual server. Transferring the SCW security policy to a GPO is a must if your organization uses GPOs extensively. If you don’t transfer the SCW security settings to a GPO, they could be overridden by settings defined in Active Directory (AD) GPOs.

To transform SCW policies into GPO settings, use scwcmd.exe, a command-line utility that's included with the SCW. The following command is an example of how you can use scwcmd.exe to transform the fileserver.xml SCW security policy file into a GPO called FileServerPolicy:

scwcmd transform /p:%windir%securitymsscwpoliciesfileserver.xml /g:FileServerPolicy

When you run this command, the SCW will create a GPO folder for the newly created GPO in the SYSVOL folder. This folder will contain an .inf file for the security settings GPO extension, a .pol file for the Windows Firewall GPO extension, and an IPSec configuration blob for the IPSec GPO extension.

After the GPO has been successfully created, you can link it to an AD object. For example, you can link the GPO to an AD organizational unit (OU) to apply the SCW settings to the machines that are stored in that OU. When linking an SCW-derived GPO to an AD object, you must make sure that you link it at the right AD level. Keep in mind the AD GPO application order (i.e., Local GPO, Domain GPO, Site GPO, Parent OU GPO, Child OU GPO) and the fact that GPOs that are applied later in the application process will overwrite GPOs that were applied earlier.

You can use the SCW to reduce the attack surface of a Server 2008 server; however, using the SCW in Server 2008 is less useful than it is in Windows 2003 because some of the SCW’s tasks are now performed by the Server Manager. When you install Server 2008, the Server Manager automatically determines what's needed based on the server roles the administrator selects, and it implements the minimum functionality that's required for those roles.