S 4.420 Secure use of the Maintenance Center under Windows 7

Initiation responsibility: Administrator, IT Security Officer

Implementation responsibility: Administrator

The Maintenance Center under Windows 7 is the successor of the Security Center. The Security Center has already been used since Microsoft Windows Vista. The Maintenance Center is available without distinction in the range of functions in all Windows 7 editions.

In the Maintenance Center, the security settings, maintenance settings as well as troubleshooting can be centrally monitored and configured. The Maintenance Center depends on the following Windows services, which ensure that problems are diagnosed automatically and reported to the user via the Maintenance Center:

"Troubleshooting" is a collection of applications and collects information and approaches to existing problems which might occur in Windows 7-based IT systems. An Internet connection is required to call up proposals for solutions from Microsoft. Furthermore, new approaches and components are searched for at regular intervals on Microsoft servers and downloaded. To avoid sending organisation- or computer-specific configurations to Microsoft, this setting should be deactivated.

If a specific problem occurs, data is collected to obtain specific proposals for solutions on the Windows client and sent to Microsoft. Information on which data is collected in the individual case can be found in the detailed information contained in the problem report. The problem report always contains information on the operating system as well as on the hard- and software of the IT system. The report may also include personal data. If a problem was detected, troubleshooting can try to solve it independently. For this purpose, it makes changes to the configuration of the system.

For the secure use of the Maintenance Center and its functions, the following aspects should be implemented:

Since the Windows services cause problems with other services, the default start settings of the Windows services must be retained. Otherwise, important Windows services might not function properly.

Windows service Default start type
Diagnostic Policy Service (DPS) Automatic
Diagnostic Service Host (WDiSvcHost) Manual
Diagnostic System Host (WDiSystemHost) Manual
Windows Error Reporting Service (WerSvc) Automatic

Furthermore, the following settings should be implemented for each group policy and for each Windows 7-based IT system:

In order to prevent further security-endangering functions, the following settings should be configured:

For the handling of the Maintenance Center and the potential dialogue still displayed to the user following the implementation of the settings, a binding regulation on how the user has to proceed should be defined. In addition, the regulation should also include if and when the user may start the Maintenance Center component manually (see S 2.4 Maintenance / repair regulations). Normally, problems occurring during the operation of an IT system should be escalated to the persons intended for this purpose (see S 2.1 Specification of responsibilities and provisions).

Review questions:

© Federal Office for Information Security. All rights reserved.