Tài liệu Methods of Restricting Registry Access phần 4 doc

 /log log_filename-specifies a file in which to log the status of the import process.
If not specified, the import-processing information is logged in the scesrv.log file
which is located in the %windir%\security\logs directory.
 /quiet-specifies that the import process should take place without prompting the
user for any confirmation.
Secedit /export-allows you to export security settings stored in the database. The syntax
of this command is:
secedit /export /db db_filename [tablename] /cfg cfg_filename [/areas
area1 area2 ] [/log log_filename]
 /db db_filename-specifies the database used to perform the security configuration.
 /cfg cfg_filename-specifies a security template to export the database contents to.
 tablename-specifies the table to export data from. If no argument is
specified, the configuration table data is exported.
 /areas-specifies the security areas to export. If this parameter is not specified, all
security settings defined in the database are exported. To export specific areas,
separate each area by a space. The following security areas are exported:
 SECURITYPOLICY-Account Policies, Audit Policies, Event Log Settings
and Security Options.
 GROUP_MGMT-Restricted Group settings
 USER_RIGHTS-User Rights Assignment
 REGKEYS-Registry Permissions
 FILESTORE-File System permissions
 SERVICES-System Service settings
 /log log_filename-specifies a file in which to log the status of the export process. If
not specified, the export-processing information is logged in the scesrv.log file
which is located in the %windir%\security\logs directory.
Secedit /generaterollback-allows you to generate a rollback template with respect to a
configuration template. The syntax of this command is:
secedit /generaterollback /cfg cfg_filename /rbk filename [/log log_filename]
[/quiet]
 /db db_filename-specifies the database used to perform the rollback.

 /cfg cfg_filename-specifies a security template with respect to which a rollback
template is generated. Security templates are created using the Security Templates
snap-in.
 /rbkfilename-specifies a security template into which the rollback information is
written. Security templates are created using the Security Templates snap-in.
 /log log_filename-specifies a file in which to log the status of the rollback process.
If not specified, the rollback-processing information is logged in the Scesrv.log
file, which is located in the %windir%\security\logs directory.
 /quiet-specifies that the rollback process should take place without prompting the
user for any confirmation.
In addition, secedit.exe can be used to apply a single node from a security template. Thus,
to reapply your preferred file permissions, you can use a single command-line command.
To reapply your preferred registry permissions, you can use another line. Put both
commands in a batch file or write a simple script, and you can reapply both file
permissions and registry permissions across multiple servers. And you can use the
scheduling service (schtasks.exe) to periodically refresh these settings without any
replication burden. After testing the statements, you can schedule a periodic refresh by
putting both commands (or the combination line) in a batch file. Test the batch file. If
successful, use the task scheduler or schtasks.exe to schedule the refresh. Table 9.1

provides an explanation of the most useful schtasks.exe command-line switches;
additional switches are available.

Table 9.1: The Switches for schtasks.exe
Switch Description
/create Create a task
/tn The name of the new task
/tr The name of the batch file or command to run
/sc When to schedule the repetitive event (once, every n times a month, every month,
every n times a day, at this time every day, and so on)

/d Which day of the week; Monday is the default, so I could have left out this switch
in the example; /d * runs the process every day
/ru Under whose authority; if a user account name is entered here (use the
domainname\username format), the password is entered using the /rp switch; to
use a local computer account use the \machine switch and \u and \p parameters
(when the SYSTEM account is used, no password is entered)

The Most Important Registry Keys that Need Protection
Microsoft officially recommends that system administrators restrict user access to certain
subkeys under HKEY_LOCAL_MACHINE\SOFTWARE. The purpose of this restriction
is to prevent unauthorized access to the software settings.

N
ote Microsoft officially recommends that system administrators restrict user access to
the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
N
T\CurrentVersion and
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion.
For all earlier versions of Windows NT-based systems, including Windows 2000, it
is recommended that the user restrict the Everyone group (note that in Windows XP
and Windows Server 2003 the Everyone group has been restricted by default). For
the Everyone group, it's sufficient to have the Query Value, Enumerate Subkeys,
N
otify, and Read Control rights to the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
N
T\CurrentVersion registry key and the following subkeys under this key:
AeDebug, Compatibility, Drivers, Embedding, Font Drivers, FontCache,
FontMapper, Fonts, FontSubstitutes, GRE_Initialize, MCI, MCI Extensions, Ports

(and all its subkeys), Type 1 Installer, Windows 3.1 MigrationStatus (and all its
subkeys), WOW (and all its subkeys).
The same set of access rights (Query Value, Enumerate Subkeys, Notify, and Read
Control) needs to be assigned to the Everyone group for the Uninstall, Run, and
RunOnce subkeys under
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion.
Microsoft also recommends that you restrict user access to the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Perflib key that stores the data, which governs system performance.
In Windows NT 4.0, the Everyone group by default has Read access to this key (it's
recommended that you delete this group from the Perflib ACL). As shown in Fig. 9.15
, in
Windows Server 2003, the Everyone group by default has no access to this key.

Figure 9.15: Restricting access to the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Perflib registry key
The Everyone group has restricted access rights (only Query Value, Enumerate Subkeys,
Notify, and Read Control) to other registry keys, including HKEY_CLASSES_ROOT
root key and all its subkeys, and for the HKEY_USERS\.DEFAULT key. By protecting
these keys, you protect important system settings from changes (for example, this will
prevent users from changing the filename extension associations or specifying new
security settings for Internet Explorer).
Furthermore, it's necessary to restrict the Everyone group access to keys such as
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Shar
es and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UPS. The
Everyone group only needs the following rights to these keys: Query Value, Enumerate
Subkeys, Notify and Read Control. By setting these restrictions, you'll prevent
unauthorized access to shared system resources and to using the ImagePath setting under
the UPS key for starting undesirable software. Only the operating system (System) and

members of the Administrators group need Full Control access to these keys.
Finally, it is necessary to provide a tip, universal for all Windows NT-based systems. Pay
close attention to the Run, RunOnce, and RunOnceEx registry keys under
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion. For
example, the system runs all the programs listed under the RunOnceEx key only once,
and then deletes the settings specifying the starting parameters for these programs. It's
easy to see that these registry settings may allow users to run undesirable software on the
local computer. Thus, Full Control access to this key should only be provided to the
operating system (System) and members of the Administrators group. The list of registry
keys, which are used most often for installing worms, viruses, and Trojans, is provided
below:
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\R
un
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\R
unServices
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\R
unOnce
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\R
unServicesOnce
 HKEY_USERS\DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ru
n
 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ru
n
 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ru
nServices
 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ru
nOnce
 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ru
nServicesOnce
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\R

unOnceEx
Therefore, if you suspect that your computer is infected, these registry keys must be
checked first. Furthermore, the list of such keys is constantly being supplemented. Since
recently, the following keys have been included into this list:
 HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths
 HKLM\Software\Microsoft\Windows\CurrentVersion\Controls Folder
 HKLM\Software\Microsoft\Windows\CurrentVersion\DeleteFiles
 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer
 HKLM\Software\Microsoft\Windows\CurrentVersion\Extensions
 HKLM\Software\Microsoft\Windows\CurrentVersion\ExtShellViews
 HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings
 HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage
 HKLM\Software\Microsoft\Windows\CurrentVersion\RenameFiles
 HKLM\Software\Microsoft\Windows\CurrentVersion\Setup
 HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs
 HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions
 HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall
 HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility
 HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers
 HKLM\Software\Microsoft\Windows NT\CurrentVersion\drivers.desc
 HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\0
 HKLM\Software\Microsoft\Windows NT\CurrentVersion\Embedding
 HKLM\Software\Microsoft\Windows NT\CurrentVersion\MCI
 HKLM\Software\Microsoft\Windows NT\CurrentVersion\MCI Extensions
 HKLM\Software\Microsoft\Windows NT\CurrentVersion\Ports
 HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
 HKLM\Software\Microsoft\Windows NT\CurrentVersion\WOW

N
ote It's necessary to mention one more registry key, which is also very important in

terms of security. When you work with the Remote Access Service (RAS), the
system sometimes displays dialogs prompting you to enter a login name and
password. These dialogs often contain checkboxes, which allow you to save the
password (for example, Save This Password or Remember This Password).
Although this feature is very convenient for end users, it can possibly be very
dangerous, because the passwords are stored in such a way that they can be easily
retrieved by the system (and, for that matter, by anyone else). This is especially
important for those of you working with laptops and other portable computers,
because if your machine is lost or stolen, the person who finds (or steals) it will
have access to all your networks.
The easiest way to protect yourself against this risk is to disable the feature for saving
RAS passwords on RAS clients. Open the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Para
meters key and add the REG_DWORD setting named DisableSavePassword. Now the
system won't prompt you to save your RAS password.