S 2.370 Administration of access rights under Windows Server 2003 and higher

Initiation responsibility: IT Security Officer, Head of IT

Implementation responsibility: Head of IT, Administrator, Specialists Responsible

Overview of the authorisation concepts available

The Windows security model, with its accounts, groups, and access authorisations, is by no means limited to objects in the NTFS file system. In fact, authorisations for each type of account requiring authentication can be specified in detail in almost all areas of the operating system. Therefore, a separate authorisation concept must be created for Windows servers.

Aspects of the Windows server authorisation model under Server 2003 and higher are:

The following authorisation settings are not part of the authorisation model named above:

The capabilities of these authorisation settings are explained in the Resources for IT-Grundschutz (see Administration of authorisations under Windows Server 2003 in the Resources for Windows Server 2003).

Training

Understanding of the mechanisms listed above and the underlying philosophies must be provided to the administrators in the form of training and technical books. Otherwise, secure operation of the mechanisms used, and therefore of Windows Server, cannot be guaranteed overall.

Depending on the tasks performed by the administrators, they should also receive training in the use of the corresponding components so they can estimate the effects of authorisation configurations and plan accordingly in advance.

Details on individual authorisations in the various parts of the operating system can be found in the Windows online help system and in the Microsoft Technet documentation for administrators.

Basic rules

The administration of authorisations for user accounts and administrative accounts requires certain rules to be followed and a basic understanding of authorisation and security mechanisms. Particular care must be taken when making changes to authorisations during live operation (if the changes have not been tested beforehand) to ensure the availability of the IT system is not endangered.

When performing all tasks and planning in connection with the granting of authorisations, you must abide by the principle of least privilege. According to this principle, an account should not be granted wide-ranging privileges as a "precaution", but should only be granted the authorisations required to fulfil the requirements defined for the account. Authorisations can be granted step-by-step to obtain a higher level of authorisation when the requirements justify this. For example, an account should not be granted full access to a resource if the user of the account does not need to perform administrative tasks on the resource.

A general difficulty is predicting the effects of a certain authorisation configuration. Windows servers provide various simulation tools for predicting the effects of authorisation configurations:

The simulation tools should be used extensively when modelling authorisations and when performing administration tasks during live operation. It is recommended to state this in a corresponding security policy for the configuration change release process.

Account sharing, forgotten passwords

User accounts may not be used by more than one person (referred to as account sharing). This applies to administrative accounts as well as to normal user accounts. If an administrator needs to be provided with a shared account for compelling organisational reasons, then each case of such a shared account is to be documented and reasons for sharing the account provided. The account used, the method for enforcing the password policies, the authorisations (ACL), the monitoring settings (SACL), and the authorised group of people are to be documented. Misuse of such accounts can only be prevented through organisation. Shared user accounts, like administrative accounts, are to be considered critical accounts and must be taken into account when monitoring the system.

The Forgotten Password Wizard under Windows XP and Server 2003 and higher is used to reset forgotten local passwords without deleting the private key stored locally. This wizard should not be used in an environment using centralised authentication since it undermines the security of such a concept. Creating data media by means of which the password can be reset ("Password Reset Disc") is not allowed. This must be stated in the security policy and can be implemented using group policies, for example.

Review questions:

© Federal Office for Information Security. All rights reserved.