Setting NT Policies

Summary

Three separate policies can be set via User Manager for Domains. Account Policies are used .... User Rights Policies are used.... Audit Policies are used to track security events and log them to the NT Security Event log.

Account Policies

The domain Account Policies are modified by selecting "Policies/Account..." from the User Manager for domains. The parameters shown in the following two tables are set on the same window.

Password Restrictions

Account Lockout

User Rights Policies

The User Rights policy manages the rights granted to groups and user accounts. A right authorizes a user logged on to an account to perform certain actions on the system. When a user does not have appropriate rights, attempts to carry out those actions are blocked.

Rights apply to the system as a whole and are different from permissions, which apply to specific objects. Members of a group have all the rights granted to that group. In most situations, the easiest way to provide rights to a user is to add that user's account to one of the built-in groups that already possesses the needed rights, rather than by administering the User Rights policy.

The User Rights

The list below provides descriptions of user rights that can be managed with the User Rights policy. Two advanced user rights (Bypass traverse checking, and Log on as a service) may be of interest to administrators, and are therefore included in the list.

• Access this computer from network
• Add workstations to domain
• Back up files and directories
• Change the system time
• Force shutdown from a remote system
• Load and unload device drivers
• Log on locally
• Manage auditing and security log
• Restore files and directories
• Shut down the system
• Take ownership of files or other objects
• Bypass traverse checking (advanced right)
• Log on as a service (advanced right)

Note: Some advanced user-rights can also be managed with the User Rights policy. Most of these are useful only to programmers writing applications for computers running Windows NT Workstation or Windows NT Server, and will not usually be granted to a group or user. For information about advanced user rights, see the Windows NT Server programming documentation.

When to change the default settings

Normally, you will not have to change the default user rights settings. However, it may be desirable on some servers, to prevent users from logging in directly to the server console. In this case, you could remove the Users and Guests groups from the logon locally right. Conversely, if users from another domain need to logon locally to this server, the global group that contains the users that need this right should be added to the logon locally right.

To manage the User Rights policy

1. On the Policies menu, click User Rights.
2. Select a user right from those listed in Right. The users and groups who currently have that right appear under Grant To.
3. To grant the selected right to additional groups or user accounts, click Add, and complete the Add Users and Groups dialog box.
4. To remove a group or user account from the list, select a name in the Grant To box, and then click Remove.
5. Repeat steps 2 through 4, as necessary
6. To administer the advanced user rights, select the Show Advanced User Rights check box and repeat steps 2 through 4, as necessary.

Audit Policies

Setting the Audit Policy

Selected activities of users can be tracked by auditing security events and then placing entries in the computer's security log. Use the Audit policy to determine the types of security events that are logged. Because the security log is limited in size, carefully select events to be logged. The maximum size of the computer's security log is defined in Event Viewer. Entries in a security log can be reviewed using Event Viewer.

To manage the Audit Policy

1. On the Policies menu, click Audit.
2. To record events in the security log, click Audit These Events. Or, to not record any events in the security log, click Do Not Audit.
3. If you selected Audit These Events, click to select or clear the Success and Failure check boxes for each type of event.

Notes and Tips

• When administering domains, the Audit policy affects the security logs of all domain controllers in the domain because they share the same Audit policy.
• When administering a computer running Windows NT Workstation or Windows NT Server that is not a domain, the Audit policy affects only the security log of that computer.
• Entries in a security log can be reviewed using Event Viewer.
• Because the security log is limited in size, carefully select which events to log. The maximum size of each computer's security log is defined in Event Viewer.

Settings to be Used

For all domain controllers, PDCs and BDCs, use the following settings:

For application servers, auditing should be implemented as required by the application owner. Again, it is important to set the size and retention period of the Security Event Log to an appropriate level.