Testing Group Policy security

Testing Group Policy security

You may have implemented the critical Group Policy settings I highlighted in my previous tip to protect Windows from attacks against logins, passwords, remotely-accessible services, and physical weaknesses -- but are you sure all of your Group Policy settings are actually working? In this tip, I'll take an auditing perspective to help you find out if Group Policy settings are actually in place.

The first, rather obvious action would be to simply load up the Group Policy Management Console (GPMC) and go down a checklist to make sure all the settings you think are enabled are truly enabled. This is easily done via the GPMC Settings view for your Default Domain Policy or separate Group Policy Objects (GPOs). That's something a non-technical IT auditor could do, but it may be a little too basic for you. What if the GPOs have not propagated through the entire network, or other system and user policies have been created that override Group Policy settings? These are easy to miss when simply scanning the configuration settings with your own eyes.

I like to see how everything looks using automated tools when possible. This method is not only used by attackers, but it also takes the grunt work out of the testing process and helps ensure nothing is overlooked. One of my favorite tools for testing Group Policy settings is Qualys' QualysGuard. It allows

    Requires Free Membership to View

    Login

    When you register, you’ll also receive targeted alerts from my team of editorial writers and independent industry experts with the latest news, tips, and advice to help you do your job more efficiently and effectively. Our goal is to keep you informed on the hottest topics and biggest challenges faced by IT professionals today working with desktop management and security technologies.

    Margie Semilof, Editorial Director

    By submitting your registration information to SearchEnterpriseDesktop.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchEnterpriseDesktop.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

you to scan your Windows systems from both angles -- that is, unauthenticated (not logged in) and authenticated (logged in) -- and provides a ton of Group Policy and other operating system configuration details. You can also use some other low-cost and free tools such as LANguard Network Security Scanner, SuperScan, LanSpy, and MBSA to gather some basic policy information off the systems you're testing.

When running your tests, I highly recommend performing both unauthenticated and authenticated scans. The unauthenticated scans give you a true outsider's perspective of your Group Policy settings to point out any major holes, including ineffective password and intruder lockout policies, audit logging, file and share permissions, and account enumeration via null sessions. The authenticated scans give you a complete view of your Group Policy and Windows settings without having to worry about whether or not you've missed something in your unauthenticated scans. Authenticated scans provide an auditor's perspective looking at everything in detail -- plus it's a heck of a lot faster and more accurate than scanning all your systems manually.

I also recommend scanning your servers as well as your critical workstations -- every system if possible. Again, this can help identify misconfigured system or user policies that you might not catch by looking at your servers and domain controllers by themselves. This will add some time to your testing process since you'll have to review the results of each system you test, but it's the only true way to identify any security shortcomings. As far as how often you should perform these tests -- especially if you test every system -- is up to you, but I'd recommend at least once a year if not more. This becomes increasingly important if you're always tweaking your Group Policy settings, adding new systems or upgrading existing ones to new versions of Windows.

About the Author: Kevin Beaver is an independent information security advisor with Atlanta-based Principle Logic LLC. He has over 17 years of experience in IT and specializes in performing information security assessments. Beaver has authored five information security-related books including Hacking For Dummies (Wiley), the brand new Hacking Wireless Networks For Dummies and The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach). He can be reached at kbeaver@principlelogic.com.

More information from SearchWindowsSecurity.com

  • Tip: Configure Group Policy to prevent attacks
  • Tip: Ten attacks you can easily avoid with Group Policy
  • Topics: Get news and expert advice on hardening Group Policy


    • This was first published in August 2005

    Join the conversationComment

    Share
    Comments

      Results

      Contribute to the conversation

      All fields are required. Comments will appear at the bottom of the article.

      Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

      Back to top