Configuring NT-services much more secure

Introduction

Windows 2000 and XP belong to the same NT family like NT4 or Win2003 Server. NT means "NT New Technology" and was introduced by Microsoft with the new developed 32-bit server operating System Windows NT 3.1 back in 1993.
But Microsoft doesn't do a good job here: (unnecessary) network services are not disabled by default what breaks an important law of networking: "Do not offer services, you really don't need". Services are programs starting up while the operatin system boots. They don't need any interactive or log on action by user and do provide features which may be used by other programs. For instance: a stand alone workstation doesn't need any network services, so it's smart switching them off. As you see it is important to configure computer systems as secure as needed. That avoids and minimizes attacks to your IT-Infrastructure and preserves the reliability of your enterprise or home workstation.

To follow up these security measures the following manuals are available describing the safe and secure configuration of NT-services on Windows2000 and Windows XP environments. They also describe the way how to change start-up type (auto, demand, disabled) of  the services. After that you won't offer unnecessary services to the world wide web anymore and avoid/minimize the risk of damage.

The bunch of different services makes it very difficult to ensure a secure configuration as you have to manage many machines (i.e. in small sized industries). To avoid mistakes there is a script available using the WindowsNT command line interface to configure services as safe and comfortably as possible. Th following actions are performed by this script:

• Change start type (auto, demand,disabled)
• Stop and disable critical services (i.e. Distributed Transaction Coordinator, Messenger)
• Disable DCOM and removes standard protocol bindings
• Close SMB /server message block) and consequently port 445 (only if you use switch "/std" or "/all")
• Disable DHCP if not needed
• Disable NetBios on all network interfaces (exception: switch "/lan" prevent it)

Version 2.2

Back in January 2004 we introduced a new and improved version v2.0, which unfortunately raised the code complexity same time. For that reason Ansgar Wiechers started helping me to "re-facture" the complete script. At the end version v2.2 was released for download. This new version offers much better compatibility for Windows XP SP2 and SP3 environments, a re-designed GUI, new features (i.e. fingerprinting) and more security options. According to your personal preferences, you get more options to get your workstation back in a safe and secure state. Next an introduction tells you briefly about all new features.

Example:
svc2kxp.cmd /std (recommended for stand-alone computers using dial-up internet connections)
svc2kxp.cmd /lan (Warning: retains basic (native) network support for computers connected to a LAN/WAN) or via a DSL/Cable modem.

Choosing one option only (e.g. LAN, Standard oder All) is good enough. In order to run the script, file SC.EXE" is requiered. This file is part of Windows XP, the W2k/XP-ResourceKit and also VisualStudio.NET. On an active internet connection the script may try to download the required file SC.EXE and copy to the \SYSTEM32 directory. Alternate sources for this file are: ftp://ftp.microsoft.com/reskit/win2000/sc.zip or http://www.dynawell.com/reskit/microsoft/win2000/sc.zip Unzip file SC.EXE from archive and copy it to Winnt/System32/ respectively Windows/System32/. Using this script is NOT recommended for LAN/network environments!

The checklist

Please be aware that the offered script will only carry out parts of the steps from the tutorial at ntsvcfg.de. Some are still left to be changed manually. What the script does and what needs to be done by the user do, just look at the following overview:

Index:
   user needs to perform changes or check for proper execution
   already done by the script

Known problems:

• Scheduler: When you start the scheduler, in some cases an error message ("wrong parameter") pops up. To solve this issue simply download this patch: ntsvcfg_fix.zip. Unzip the file ntsvcfg_fix.reg and import it to your registry with a double-click. Please mind that port 135 (RPC) may still left opened.
• DNS: In rare cases, the DNS name resolution doesn't work on Windows 2000 SP2 machines anymore. Installing SP4 for Windows 2000 can solve this problem.
• ICS / XP-Firewall: Depending on the feature called "internet connection sharing", there were some problems reported by users: clients can't connect to the internet thru the ICS-server. Please check if the following services are running: "internet connection sharing", "SSDP-search", "universal plug & play host" and in rare cases "DHCP-client". These services got disabled by the script.
• DHCP: In rare cases, the DHCP-assignment doesn't work properly and therefore the service "DHCP-client" was mistakenly disabled. If you're using DHCP, please check whether this service is up and running or not. Especially users with DSL/Cable modem are advised to enable the DHCP Client again.
• Network printing & -sharing: Despite using option "(4) restore", there may be problems while using network printer. Please check if NetBIOS is enabled by opening the advanced TCP/IP-properties tab of your internet adapter.
• Network neighbourhood: After using option (1) LAN, other network computers may not be displayed anymore in the Windows network neighbourhood. To fix this please start the service "Computer Browser" and in case the "Windows Firewall" is needed, please restart this service too. If no static name resolution is available, you should also re-enable "NetBIOS" in your TCP/IP-connection properties menu.
• IIS won't start: Please read and follow up the instructions described at "Scheduler workaround".
• Prefetching: Windows XP uses the prefetching technology in order to optimize processes at start up. Therefore problems might come up in case the scheduler service got disabled by the script. If you are getting error messages, experiencing problems or plan to further use this feature, please re-enable the scheduler service manually.
• Outlook Express cannot connect to MS Exchange server: Basicly svc2kxp.cmd wasn't designed to run on NT servers. If you get the message "...could not open the information store" simply re-import dcomp.reg located at the %USERPROFILE% directory by double clicking on that file.
• Special keys on keyboards: In some cases special featured keys on multimedia keyboards working improperly. To solve this problem re-enabling the service HIDServ.
• ATI graphic card drivers: Installation und deinstallation of "Catalyst" drivers may cause problems because the ATI installer needs RPC(with binding to LAN interface) and DCOM (incl. the Distributed Transaction Coordinator service)- whyever. The "OMEGA" driver series ist not affected.
• "Run as..." function not available: To run programs with alternative login the Run As Service should be enabled and running.
• CAPI problems: Using script, especially Option "(3) ALL" under Win2000, in some cases an (ISDN-)CAPI error appears ("ISDN driver not loaded"). Please check if the RPC service is set to "auto" and is running. Nevertheless an alternative resolution is to import the file "dcomp.reg", situated in your "%USERPROFILE%/ntsvcfg" directory, and reboot afterwards.
• Windows update v5 (WinXP): After installing SP2 for Windows XP the windows update feature might me troubled by executing the script svc2kxp.cmd with option "(3) /ALL (hardening)". If you are intend to further-use Windows Update v5 reactivate following services: BITS - intelligent background transmitting service; auto windows update. Although using option "(4) restore" there could be problems using network printer. Please check if NetBIOS is activated in the advanced TCP/IP-properties tab of your internet adapter.

Notice: There is no support for Windows NT4 and W2k3 (server) by the script.

"Everything Alright?"

To check whether all unnecessary services are terminated and all ports are in the state "closed" or not, please follow the instructions from this this website: http://www.linux-sec.net/Audit/nmap.test.gwif.html. (Remember: Not every internet service provider (ISP) allows you testing your computer for open ports. Therefore results may be incorrect if the ISP uses a proxy.)

Are ports still open out there? Check and find out more about reasons:

• port 135 - caused by messenger, scheduler, distributed transaction coordinator, DCOM (incl. protocol bindings)
• port 137..139 - caused by NetBios (can be deactivated in the "TCP/IP-properties" tab -> "[x] deactivate NetBIOS")
• port 445 - caused by SMB, that is used for network sharing and -printing over TCP/IP
• Port 1025 - caused by scheduler service for instance.

Advanced configurations for a Windows 2000/XP environment

(1) Apply user-rights

For daily use working with user-rights only and not as administrator is one of the best and most effective way to protect your computer from getting compromised. Also use NTFS as file system allowing you to setup permissions for extra security and protect your PC against spyware, malware, trojans, and more.

• Windows XP Home: You should check whether the password of the administrator account is left blank (by default) or not. If it is blank, then everyone getting access to your computer (even through network) is able log on, access your private data and may harm your whole system.

(2) Keep your Windows up-to-date

Every day new security leaks in operating systems are disclosed, so it is necessary to keep your Windows up to date. Simply visit the Windows-Update website and install all important updates and service packs. In addition to that, this script configures the NT Services properly. But it doesn't patch or update anything!

• Install "all important updates & service packs" from windows update:
  => http://windowsupdate.microsoft.com
  To check for missing patches use:
  => http://hfnetchk.shavlik.com/ or Microsoft Baseline Security Analyzer
  
  
• Blaster/RPC-Patch:
  Important: don't connect your W2K/XP-PC to the WWW before the RPC patch was installed and the security hole in RPC-service (Remote Procedure Call, Port 135) was closed. Download this patch on a non-comprommised or non-affected system (i.e. Knoppix or Unix/Linux):
  =>http://support.microsoft.com/?kbid=824146
  Which RPC-patch still missed or if it was installed correctly:
  http://support.microsoft.com/?kbid=827363 and http://www.pcwelt.de/downloads/system/system-utilities/33185/
  
  
• LSASS-vulnerability
  In the middle of April 2004 Microsoft published a patch KB835732 closing security holes of the Local Security Authority Subsystem (LSASS) on Windows NT4/2K/XP/2K3 systems. Otherwise buffer-overflows could lead execution of malcious code on affected operating systems (2K/XP). So its recommended, to apply this patch instantly.

(3) Configure services proper and much more secure

How to do this? Read the tutorial on the upper part of this website so you don't offer unnecessary services after there and minimize the risk of damage to your system. To support your effort for a proper-configured system use the offered script "svc2kxp.cmd".

(4) Don't use Microsoft Internet Explorer/Outlook Express!

It is recommended to use a safe and secure browser. Internet Explorer and Outlook Express aren't it because of mistakes in concept (i.e. ActiveX) and too much critical failures allowing exploits to hijack your IE. The "zones model" is also affected so it isn't trustworthy anymore

Browsers like the suite Mozilla (browser/email/news) or Firebird/Firefox (browser) and Thunderbird (email/newsgroup) as stand-alone derivates of Mozilla and also Opera are a good choice.

z.B. Mozilla + Sun JRE (Java)

(5) Activate the XP-Firewall

WindowsXP has a build-in Firewall (also called Internet Connection Firewall, ICF) which is integrated in the TCP/IP stack. Please notice that this firewall isn't globally activated by default so you have to turn on it for every internet adapter (once for permanent and every time for non persistent internet connections). The advantage of this firewall is a very simple configuration and a low risk of unauthorized changing the configuration (i.e. parameters, rules).

(6) More information about computer security:

• MS TechNet: The Ten Immutable Laws of Security
• The Linkblock (german)

Other contributions to security

Communities

Get the news up to the minute - follow us on Twitter...

Credits

At this time I want to say THANK YOU to all people who are helping me creating this website and the offered script and making this projekt possible, especially:

Bernd Eckenfels, Wolfgang Ewert, Stephan Grossklass, Chris Haaser, Sybille Kahl, Stefan Kanthak, Besim Karadeniz, Rüdiger Lahl, Daniel Leidert, Johannes Lichtenberger, Joachim Meyer, Harald Mühlböck, Michael Paul, Jürgen Port, Manuel Reimer, Rüdiger Rösler, Björn Schliessmann, Alexander Skwar, Ralf Storm, Jörg Ulbrich, Karin Weber, Ansgar Wiechers, Thomas Winter.

Also to Christian D. Anderson from www.dupond.com helping me during translating parts of this site.