操作系統(tǒng)審計(jì)檢查表

1、然后操作系統(tǒng)審計(jì)檢查表WINDOWS sp sp3安全審核被審核部門審核人員審核日期2013-12-21序?qū)徍瞬襟E /方法審核結(jié)果審核項(xiàng)目號(hào)補(bǔ)丁安裝情況1 security updates are1missing.113 security updates are missing. 4 servicepacks or update rollups are missing.主要帳戶密碼長(zhǎng)度最少 8 位，密碼周期最長(zhǎng)為 90 天策略審查20審核策略對(duì)所有帳戶登錄事件進(jìn)行審核對(duì)所有的帳戶管理事件進(jìn)行審核對(duì)所有登錄事件進(jìn)行審核3審核失敗訪問(wèn)的組件未審查對(duì)策略更改事件進(jìn)行審核審核失敗的特權(quán)事件審核所有系統(tǒng)

2、事件陪同人員補(bǔ)充說(shuō)改進(jìn)建議明沒(méi) 有 更設(shè)置自動(dòng)更新新設(shè)置密碼策略，把沒(méi) 有 設(shè)密碼長(zhǎng)度最小值設(shè)置 密 碼置為8，密碼最長(zhǎng)策略存儲(chǔ)期設(shè)置為90沒(méi) 有 設(shè)進(jìn)行策略審查安全置設(shè)置被審核部門序?qū)徍隧?xiàng)目號(hào)WINDOWS sp sp3安全審核審核人員審核日期2013-12-21審核步驟 /方法審核結(jié)果陪同人員補(bǔ)充說(shuō)改進(jìn)建議明帳戶策略4帳戶鎖定策略5事件日志審核6最小密碼歷史：1天最長(zhǎng)密碼周期 : 90 天最小密碼長(zhǎng)度 : 8個(gè)字符密碼復(fù)雜度 : Enabled密碼歷史 : 24 Passwords Remembered存儲(chǔ)的密碼是否可用于可逆加密：Disabled帳戶鎖定周期 : 15 Minutes (

3、minimum)帳戶鎖定條件 : 3 次失敗登錄復(fù)位時(shí)間 : 15 Minutes (minimum)對(duì)于系統(tǒng)、安全、應(yīng)用系統(tǒng)日志， 審核下面的項(xiàng)目：最大日志容量 : 80 Mb (minimum)限制 GUEST帳戶訪問(wèn)日志 : Enabled日志保持方法：“必要時(shí)候重寫日志 ”最小密碼歷史：0天最長(zhǎng)密碼周期 : 0天最小密碼長(zhǎng)度 : 0個(gè)字符密碼復(fù)雜度 : 已停用密碼歷史 :0 Passwords Remembered 存儲(chǔ)的密碼是否可用于可逆加密： 已停用帳戶鎖定周期 : 不適用帳戶鎖定條件 :次失敗登錄復(fù)位時(shí)間 : 不適用最大日志容量 : 512kb (minimum)限制 GUEST

4、帳戶訪問(wèn)日志 : Enabled 日志保持方法： 改寫久于 7天的日志沒(méi) 有 設(shè)按照要求進(jìn)行賬戶置 賬 戶策略設(shè)置策略沒(méi) 有 進(jìn)行 用 戶進(jìn)行安全設(shè)置鎖 定 策略設(shè)置按要求進(jìn)行事件查看器進(jìn)行主要安全7設(shè)置審核安全選項(xiàng)8對(duì)外在的匿名用戶禁止訪問(wèn)。Guest允許系統(tǒng)在未登錄前關(guān)閉計(jì)算機(jī)： Disabled允許系統(tǒng)在未登錄前關(guān)閉計(jì)算機(jī)：已啟用允許格式化和彈出可移動(dòng)媒體： Administrators允許格式化和彈出可移動(dòng)媒體：Administrators配 置 不按照要求進(jìn)行安全完全選項(xiàng)配置Amount of Idle Time Required Before DisconnectingAmount

5、 of Idle Time Required Before DisconnectingWINDOWS sp sp3安全審核被審核部門審核人員審核日期序?qū)徍隧?xiàng)目審核步驟 /方法號(hào)Session:30 Minutes (maximum)在超過(guò)登錄時(shí)間后強(qiáng)制注銷：Enabled系統(tǒng)關(guān)閉時(shí)清除虛存頁(yè)面文件：Enabled數(shù)字簽名客戶端通信（如可能）： Enabled數(shù)字簽名服務(wù)器端通信（如可能）：Enabled不需要按 CTRL+ALT+Delete登錄?。?Disabled不顯示上次登錄的用戶名：EnabledLAN Manager Authentication標(biāo)準(zhǔn) l: “ SendNTLMv2

6、response only ”(最少 )用戶登錄時(shí)顯示的消息文字：Custom Message or“This system is for the use of authorized users only.用戶登錄時(shí)顯示的消息標(biāo)題：“Warning: ” orcustom title .0可被緩存保存的前次登錄個(gè)數(shù)：禁止用戶安裝打印驅(qū)動(dòng) : Enabled: 14 Days在密碼到期前多少天提示用戶更改密碼(minimum)恢復(fù)控制臺(tái)（允許自動(dòng)管理級(jí)登錄）：Disabled恢復(fù)控制臺(tái)（允許對(duì)所有的驅(qū)動(dòng)器和文件夾進(jìn)行軟盤拷貝和訪問(wèn)）： Disabled重命名管理員帳戶： 除Administrat

7、or 外的其它任陪同人2013-12-21員補(bǔ)充說(shuō)審核結(jié)果改進(jìn)建議明Session: 15 Minutes (maximum)在超過(guò)登錄時(shí)間后強(qiáng)制注銷：已停用系統(tǒng)關(guān)閉時(shí)清除虛存頁(yè)面文件：已停用數(shù)字簽名客戶端通信（如可能）：已停用數(shù)字簽名服務(wù)器端通信（如可能）：已停用不需要按CTRL+ALT+Delete登錄?。簺](méi)有定義不顯示上次登錄的用戶名：已停用LAN Manager Authentication標(biāo)準(zhǔn) l: 發(fā)送LM&NTML用戶登錄時(shí)顯示的消息文字：無(wú)用戶登錄時(shí)顯示的消息標(biāo)題：沒(méi)有定義可被緩存保存的前次登錄個(gè)數(shù)：10禁止用戶安裝打印驅(qū)動(dòng): 已停用在密碼到期前多少天提示用戶更改密碼: 14

8、Days(minimum)恢復(fù)控制臺(tái)（允許自動(dòng)管理級(jí)登錄）：已停用恢復(fù)控制臺(tái)（允許對(duì)所有的驅(qū)動(dòng)器和文件夾進(jìn)行軟盤拷貝和訪問(wèn)）：已停用重命名管理員帳戶：除Administrator外的其第3頁(yè)共21頁(yè)WINDOWS sp sp3安全審核被審核部門審核人員審核日期序?qū)徍隧?xiàng)目審核步驟 /方法號(hào)何名稱重命名 Guest 帳戶：除 GUEST 外的其它任何名稱限制只有本地登錄用戶才允許訪問(wèn)軟盤： Enabled 對(duì)安全通道數(shù)據(jù)進(jìn)行數(shù)字加密 (如可能 ): Enabled 對(duì)安全通道數(shù)據(jù)進(jìn)行數(shù)字簽名 （如可能）： Enabled 發(fā)送為加密的密碼連接第三方 SMB 服務(wù)器：Disabled智能卡移除操作：

9、 “鎖定工作站 ”System Objects (e.g. Symbolic Links):Enabled對(duì)未經(jīng)過(guò)簽名的驅(qū)動(dòng)安裝行為 ： “警告 , 但允許安裝”或者 “不允許安裝 ”.陪同人2013-12-21員補(bǔ)充說(shuō)審核結(jié)果改進(jìn)建議明它任何名稱重命名 Guest 帳戶：除 GUEST 外的其它任何名稱限制只有本地登錄用戶才允許訪問(wèn)軟盤：已停用對(duì)安全通道數(shù)據(jù)進(jìn)行數(shù)字加密( 如可能 ): Enabled對(duì)安全通道數(shù)據(jù)進(jìn)行數(shù)字簽名（如可能）：已啟用發(fā)送為加密的密碼連接第三方SMB服務(wù)器：Disabled智能卡移除操作：“鎖定工作站”System Objects (e.g. Symbolic Li

10、nks): Enabled對(duì)未經(jīng)過(guò)簽名的驅(qū)動(dòng)安裝行為： “警告 , 但允許安裝”或者“不允許安裝”.注冊(cè)表安全設(shè)置審核WINDOWS sp sp3安全審核被審核部門審核人員審核日期2013-12-21陪同人員序?qū)徍隧?xiàng)目審核步驟 /方法審核結(jié)果補(bǔ)充說(shuō)改進(jìn)建議號(hào)明審核服務(wù)Alerter Disabled無(wú)審核Clipbook Disabled無(wú)審核Computer Browser Disabled無(wú)審核Fax ServiceDisabled無(wú)審核FTP Publishing Service Disabled Warning:將無(wú)審核禁止 FTP 服務(wù)IIS Admin Service Disabl

11、ed Warning: This willdisable Internet Information Services! Internet Connection SharingDisabled MessengerDisabled10NetMeeting Remote Desktop SharingDisabled Remote Registry ServiceDisabledRouting and Remote AccessDisabledSimple Mail Transfer Protocol (SMTP) Disabled Warning: 禁止在 IIS Servers 上的 SMTP

12、服務(wù)。 Simple Network Management Protocol (SNMP) Service DisabledSimple Network Management Protocol (SNMP) TrapDisabledTelnet DisabledWorld Wide Web Publishing Services Disabled 無(wú)審核無(wú)審核無(wú)審核無(wú)審核無(wú)審核無(wú)審核無(wú)審核第5頁(yè)共21頁(yè)WINDOWS sp sp3安全審核被審核部門審核人員審核日期2013-12-21陪同人員序?qū)徍隧?xiàng)目審核步驟 /方法審核結(jié)果補(bǔ)充說(shuō)改進(jìn)建議號(hào)明Warning:將禁止 Internet Infor

13、mation Services!Automatic Updates Not DefinedBackground Intelligent Transfer ServiceNotDefined用戶權(quán)利審核11從網(wǎng)絡(luò)訪問(wèn)此計(jì)算機(jī) : Users, Administrators (or none)增加工作站到域： Not applicable備份文件和目錄 : Administrators更改系統(tǒng)時(shí)間 : Administrators創(chuàng)建頁(yè)面文件：Administrators創(chuàng)建全局對(duì)象：None創(chuàng)建永久共享對(duì)象：None診斷程序：None拒絕從網(wǎng)絡(luò)訪問(wèn)此計(jì)算機(jī)： Guests 拒絕作為批處理進(jìn)行登錄

14、：None by default (others allowable as appropriate) Not Defined拒絕作為服務(wù)登錄：None by default (othersAdministrators,BackupOperators,Everyone,PowerUsers,UsersAdministrators,Backup OperatorsAdministrators,PowerUsersAdministratorsAdministrators,INTERACTIVE,SERVICRGuestWINDOWS sp sp3被審核部門審核人員審核日期序?qū)徍隧?xiàng)目審核步驟 /方法號(hào)

15、allowable as appropriate) Not Defined拒絕本地登錄 : None by default (others allowableas appropriate) Not Defined從遠(yuǎn)端強(qiáng)制關(guān)機(jī)： Administrators管理和審核安全日志：None增加內(nèi)存配額：Administrators增加進(jìn)度優(yōu)先級(jí) Administrators安裝和卸載設(shè)備驅(qū)動(dòng)程序：Administrators內(nèi)存中鎖定頁(yè)：None作為批作業(yè)登錄： None ( “Not Defined ”)作為服務(wù)登錄： None ( “Not Defined ”)本地登錄： Administra

16、tors (other specific users allowable)管理審核和安全日志：Administrators更改防火墻環(huán)境選項(xiàng)： Administrators配置單一進(jìn)程：Administrators配置系統(tǒng)性能：Administrators從插接工作站中取出計(jì)算機(jī)：Administrators替換進(jìn)程級(jí)記號(hào)：None恢復(fù)文件和目錄：Administrators關(guān)閉系統(tǒng)：Administrators安全審核陪同人2013-12-21員補(bǔ)充說(shuō)審核結(jié)果改進(jìn)建議明GuestAdministratorsAdministratorsAdministratorsAdministratorEE

17、TWORK SERVICEAdministratorsAdministrators,Power UsersAdministratorsAdministrators,Power Users,UsersLOCAL SERVICE,NETWORKSERVICE第7頁(yè)共21頁(yè)WINDOWS sp sp3安全審核被審核部門審核人員審核日期2013-12-21陪同人員序?qū)徍隧?xiàng)目審核步驟 /方法審核結(jié)果補(bǔ)充說(shuō)改進(jìn)建議號(hào)明同步目錄服務(wù)數(shù)據(jù)： Not ApplicableAdministrators,Backup Operators取得文件和其他對(duì)象的所有權(quán)： AdministratorsAdministrat

18、ors,BackupOperators,Power Users,UsersAdministrators其他系統(tǒng)12 需求確保磁盤卷為 NTFS 文件系統(tǒng)。是 ntfs;文件權(quán)限%SystemDrive% - Administrators: Full; System:%SystemDrive%ntbootdd.sys：缺省Full; Creator Owner: Full; Users: Read and%SystemDrive%Documents andExecute, ListSettingsAll UsersDocuments%SystemDrive%autoexec.batAdminis

19、trators:DrWatson：缺省Full; System: Full%SystemDrive%Temp：缺省%SystemDrive%boot.ini Administrators: Full;%SystemDrive%Program13System: FullFilesResource Kit：缺省%SystemDrive%config.sys - Administrators: Full;%SystemRoot%$NtServicePackUninstSystem: Fullall$：缺省%SystemDrive%io.sys Administrators: Full;%System

20、Root%CSC:缺省System: Full%SystemRoot%system32Ntbackup.ex%SystemDrive%msdos.sysAdministrators: Full;e：缺省System: Full%SystemRoot%system32secedit.exe：建議使用NTFS 文件系統(tǒng)按照審核方法進(jìn)行文件權(quán)限設(shè)置WINDOWS sp sp3安全審核被審核部門審核人員審核日期2013-12-21陪同人員序?qū)徍隧?xiàng)目審核步驟 /方法審核結(jié)果補(bǔ)充說(shuō)改進(jìn)建議號(hào)明%SystemDrive%ntbootdd.sys -Administrators:不能打開(kāi)文件Full; Sys

21、tem: Full%SystemRoot%system32DTCLog：缺%SystemDrive%Administrators:省Full; System: Full%SystemRoot%system32NTMSData：%SystemDrive%ntldr - Administrators: Full;缺省System: Full%SystemDrive%Documents and SettingsAdministrators: Full; System: Full; Users: Readand Execute, List%SystemDrive%Documents andSettin

22、gsAdministrator Administrators: Full;System: Full%SystemDrive%Documents and SettingsAll UsersAdministrators: Full; System: Full; Users: Readand Execute,List%SystemDrive%Documents and SettingsAllUsersDocuments DrWatsonAdministrators:Full; System: Full;Creator Owner: Full; Users: TraverseFolder/Execut

23、e File, List Folder/Read Data, Read第9頁(yè)共21頁(yè)WINDOWS sp sp3被審核部門審核人員審核日期序?qū)徍隧?xiàng)目審核步驟 /方法號(hào)Attributes, Read ExtendedAttributes, Read Permissions (This folder,subfolders, and files); Users: TraverseFolder/Execute Files, CreateFiles/Write Data, Create Folder/Append Data(Subfolders and files only)%SystemDrive%

24、Documents and SettingsDefaultUser Administrators: Full; System: Full; Users:Read and Execute, List%SystemDrive%System Volume Information (Donot allow permissions on this folder to be replaced)%SystemDrive%Temp - Administrators: Full;System: Full; Creator Owner: Full; Users:Traverse Folders/ExecuteFi

25、les, Create Files/Write Data, CreateFolders/Append Data%ProgramFiles% - Administrators: Full; System:Full; Creator Owner: Full; Users: Read and Execute, List%SystemDrive%Program FilesResource Kit Administrators: Full; System: Full安全審核陪同人2013-12-21員補(bǔ)充說(shuō)審核結(jié)果改進(jìn)建議明WINDOWS sp sp3安全審核被審核部門審核人員審核日期2013-12-2

26、1陪同人員序?qū)徍隧?xiàng)目審核步驟 /方法審核結(jié)果補(bǔ)充說(shuō)改進(jìn)建議號(hào)明%SystemRoot% Administrators: Full; System:Full; Creator Owner: Full; Users: Read andExecute, List%SystemRoot%$NtServicePackUninstall$Administrators: Full; System: Full%SystemRoot%CSCAdministrators: Full;System: Full%SystemRoot%Debug -Administrators: Full;System: Full;

27、Creator Owner: Full; Users: Readand Execute, List%SystemRoot%DebugUserMode -Administrators:Full; System: Full; Users: Traverse Folder/ExecuteFile, Listfolder/Read data, Create files/Write data (Thisfolder, only); Create files/Write data, Createfolders/Append data(Files only)%SystemRoot%Offline Web P

28、ages(Do not allowpermissions on this key to be replaced)%SystemRoot%Registration -Administrators: Full;System: Full; Users: Read第11頁(yè)共21頁(yè)WINDOWS sp sp3安全審核被審核部門審核人員審核日期2013-12-21陪同人員序?qū)徍隧?xiàng)目審核步驟 /方法審核結(jié)果補(bǔ)充說(shuō)改進(jìn)建議號(hào)明%SystemRoot%repair - Administrators: Full;System: Full%SystemRoot%security - Administrators:

29、Full;System: Full; Creator Owner: Full%SystemRoot%system32 -Administrators: Full;System: Full; Creator Owner: Full; Users: Readand Execute, List%SystemRoot%system32at.exeAdministrators:Full; System: FullAdministrators: Full; System: FullAdministrators: Full; System: FullAdministrators: Full; System:

30、 Full%SystemRoot%system32regedt32.exeAdministrators: Full; System: Full%SystemRoot%system32rexec.exeAdministrators: Full; System: Full%SystemRoot%system32rsh.exeAdministrators:Full; System: FullWINDOWS sp sp3安全審核被審核部門審核人員審核日期2013-12-21陪同人員序?qū)徍隧?xiàng)目審核步驟 /方法審核結(jié)果補(bǔ)充說(shuō)改進(jìn)建議號(hào)明%SystemRoot%system32secedit.exeAdmi

31、nistrators: Full; System: Full%SystemRoot%system32appmgmtAdministrators: Full; System: Full; Users: Readand Execute, List%SystemRoot%config Administrators: Full;System: Full%SystemRoot%system32dllcacheAdministrators: Full; System: Full; CreatorOwner: Full%SystemRoot%system32DTCLog -Administrators: F

32、ull; System: Full; CreatorOwner: Full; Users: Read andExecute, List%SystemRoot%system32GroupPolicy -Administrators: Full; System: Full; AuthenticatedUsers: Read andExecute, List%SystemRoot%system32ias -Administrators:Full; System: Full; Creator Owner: FullThe Center for Internet Security第13頁(yè)共21頁(yè)WIND

33、OWS sp sp3被審核部門審核人員審核日期序?qū)徍隧?xiàng)目審核步驟 /方法號(hào)Windows 2000 Server - Level 2 Benchmark forStand-Alone and Domain-Member ServersPage 18 of 56%SystemRoot%system32NTMSDataAdministrators: Full; System: Full %SystemRoot%system32reinstallbackups Administrators: Full; System: Full; CreatorOwner: Full%SystemRoot%syst

34、em32SetupAdministrators: Full; System: Full; Users: Read and Execute, List %SystemRoot%system32spoolprinters Administrators: Full; System: Full; Creator Owner: Full; Users:Traverse Folder, Execute File, Read, Read Extended Attributes, Create folders, Append Data %SystemRoot%Tasks -(Do not allow perm

35、issions on this key to be replaced) %SystemRoot%Temp - Administrators: Full; System: Full; Creator Owner: Full; Users: Traverse Folders/ExecuteFiles, Create Files/Write Data, Create安全審核陪同人2013-12-21員補(bǔ)充說(shuō)審核結(jié)果改進(jìn)建議明WINDOWS sp sp3安全審核被審核部門審核人員審核日期2013-12-21陪同人員序?qū)徍隧?xiàng)目審核步驟 /方法審核結(jié)果補(bǔ)充說(shuō)改進(jìn)建議號(hào)明Folders/Append Dat

36、a文件和注%SystemDrive% - Everyone: Failures (this folder,冊(cè)表審核propagate inheritable permissions to all subfoldersand files)%SystemDrive%：Everyone: Success14HKLMSoftware Everyone: Failures (this key,HKLMSoftware ：Everyone: Successpropagate inheritable permission to all subkeys)HKLMSystem ：Everyone: Succes

37、sHKLMSystem Everyone: Failures (this key,propagate inheritable permission to all subkeys)注冊(cè)表權(quán)限15HKLMSoftwareClasses - Administrators: Full;不滿足： Creator Owner:缺省System: Full; Creator Owner: Full; Users: ReadHKLMSoftware Administrators Full; System:不滿足： Creator Owner:缺省Full; Creator Owner: Full; Users

38、: ReadHKLMSoftwareMicrosoftNetDDE 滿足Administrators: Full; System: Full將管理訪問(wèn)注冊(cè)表權(quán)限設(shè)置到最高，其他用戶不擁有此權(quán)限訪問(wèn)，修改注冊(cè)表第15頁(yè)共21頁(yè)WINDOWS sp sp3安全審核被審核部門審核人員審核日期2013-12-21陪同人員序?qū)徍隧?xiàng)目審核步驟 /方法審核結(jié)果補(bǔ)充說(shuō)改進(jìn)建議號(hào)明HKLMSoftwareMicrosoftOS/2 Subsystem for NT ?Administrators: Full; System: Full; CreatorOwner: FullHKLMSoftwareMicroso

39、ftWindows不滿足： Creator Owner:缺省 ;NTCurrentVersionAsrCommands Administrators: Full;System: Full;Creator Owner: Full;Users: Read;Backup Operators: Query Value, Set Value,Create Subkey, EnumerateSubkeys, Notify, Delete, Read (this key andsubkeys)WINDOWS sp sp3被審核部門審核人員審核日期序?qū)徍隧?xiàng)目審核步驟 /方法號(hào)HKLMSoftwareMicro

40、softWindows NTCurrentVersionPerflib Administrators: Full;System: Full; CreatorOwner: Full; Interactive: Read (this key and subkeys)HKLMSoftwareMicrosoftWindowsCurrentVersion Group Policy - Administrators: Full; System: Full;Authenticated Users: ReadHKLMSoftwareMicrosoftWindowsCurrentVersion Installe

41、r - Administrators Full; System: Full; Users: ReadHKLMSoftwareMicrosoftWindowsCurrentVersion Policies - Administrators: Full; System: Full;AuthenticatedUsers: Read安全審核陪同人2013-12-21員補(bǔ)充說(shuō)審核結(jié)果改進(jìn)建議明不滿足： Creator Owner:缺省 ;滿足滿足滿足第17頁(yè)共21頁(yè)WINDOWS sp sp3安全審核被審核部門審核人員審核日期2013-12-21陪同人員序?qū)徍隧?xiàng)目審核步驟 /方法審核結(jié)果補(bǔ)充說(shuō)改進(jìn)建議號(hào)

42、明HKLMSystem - Administrators Full; System: Full;Creator Owner: Full; Users: ReadHKLMSystemClone Allow inheritable permissions to propagate to this objectHKLMSystemControlSet001 - AdministratorsFull; System: Full; Creator Owner: Full; Users:ReadHKLMSystemControlSet00 x - AdministratorsFull; System: Full; Creator Owner: F