main

Security Lockdown Wizard Coming to Windows 2003 in SP1

Tom Warren   on 04 November 2003 - 22:42 · 3 comments & 781 views

Advertisement (Why?)
The security configuration lockdown wizard for Windows Server 2003 that was supposed to be delivered shortly after the operating system shipped has now apparently been pushed into the first service pack.

Microsoft chairman and chief software architect Bill Gates mentioned such functionality during his Microsoft Professional Developers Conference keynote in Los Angeles last week. While discussing security enhancements coming in future service packs, Gates said Windows 2003 SP1 could contain a “simple configuration where you can say what the type of the server is, and have all things locked down according to exactly that use.”

The decision to put the security feature in SP1 means the feature has been delayed by at least a year. Windows Server 2003 SP1 is expected to go into beta in the first half of next year and be finished in the second half.

Originally Microsoft had talked about including functionality to securely lock down servers by role in the base operating system, which shipped in April. Shortly before the RTM of Windows Server 2003, Microsoft announced that it was packaging the functionality separately for a summer release as a Security Configuration Wizard.

News source: entmag.com


IsoBuster 1.5

Changes:
  • A cosmetic makeover. XP style on XP systems.
    • Option to change the icon-style in the left pane (TreeView), e.g. XP icons on non XP systems.
  • The installation installs both a HTML Help file (*.chm) and an old style *.hlp file.
  • This version launches the HTML Help by default if Internet Explorer 4.0 or higher is installed.
    • The old style help is launched when Internet Explorer 4.0 is not yet installed (e.g. Windows 95 clean)
  • Support for two types of Multi-File Images (e.g. *.pdi images or *.iso or *.bin images and *.gi images) (e.g. ImageFile.pdi ImageFile.pdi01 ImageFile.pdi02 ImageFile.pdi03 ImageFile.pdi04) (e.g. ImageFile.gi ImageFile(12).gi ImageFile(13).gi ImageFile(14).gi ImageFile(15).gi)
  • Splitting up image files during creation to user-specified size (e.g. DVD images into 4 files of 1 GB each)
  • Support implemented for CD-Text in CueSheet files (*.cue).
  • Support implemented for CD-Text in *.cdt files (linked via *.cue files).
  • Support implemented for creation of CueSheet files (*.cue).
  • Support implemented for creation of CD-Text files (*.cdt) linked via CueSheet files (*.cue).
  • Ability to change in the options when and how a CueSheet file is created.
  • Included Macedonian language support in the 'all languages' download
  • Included Bosnian language support in the 'all languages' download
  • Included Arabian language support in the 'all languages' download
  • Included Farsi language support in the 'all languages' download
  • Included Indonesian language support in the 'all languages' download
  • Added support for Alcohol xx% images (*.mds and *.mdf images)
    • Open via the *.mds (track/session descriptor file) to get the proper track/session layout. Including Multi-File support.
    • Open the *.mdf (data container file) to treat as an ordinary image without track/session layout data.
  • Added support for Clone CD images (*.ccd)
    • Open via the *.ccd (track/session descriptor file) to get the proper track/session layout.
    • Open the *.img (data container file) to treat as an ordinary image without track/session layout data. (Previously already supported)
  • Label Mount-Rainier discs as "CD-MRW" instead of "CD-RW" and "DVD+MRW" instead of "DVD+RW". Drive needs to be MRW capable.
  • Option to change (and store) the font of the complete application to aid in the support for special characters in combination with language dlls
  • Implementation of automatically activated Method 2 remapper.

    Improvements:
  • Improvement which works around a buggy DataFab card reader driver under Win2K and WinXP. The card reader driver bug could cause a system shut-down when IsoBuster was started up.
  • Some drives respond with "No Media Present" on commands they do not support. This caused IsoBuster to assume there was no media or that the media was blank. A work-around has been implemented.
  • Some drives (or most drives at some point) don't implement MMC correctly. In case of a single track CD-RW IsoBuster could get confused about the track length on some CD-ROM drives.
  • Improvements in the SPTI vs Aspi Communication layer selection. Sometimes Aspi couldn't be selected on NT, 2K and XP systems if SPTI couldn't find drives at startup. SPTI is now also selectable in case you have no administrator rights on NT, 2K and XP. In case you have no administrator rights, the help file explains what your administrator must select to grant you low level drive access.
  • In case of (S)VCD, and in case files are located on M2F2 sectors (e.g. mpg files), "Extract" will work just as it did in versions 1.3 and lower. As of version 1.4 normal "Extract" returned errors because IsoBuster wanted to read strictly 2048 bytes user data per block.
  • This was done to avoid problems with marginal drives that return bogus data in case of raw reading. The improvement is still a lot stricter than versions 1.3 and lower. IsoBuster will now extract raw and convert to user data automatically on "Extract" BUT only on real (S)VCD files, e.g. AVSEQ01.DAT or MUSIC01.DAT in the MPEGAV directory. So if a CD looks like a VCD (because of certain parameters) "Extract" will still be strict unless the file is a real (S)VCD file in which case the data is extracted raw and converted to user data in the background.
  • Indirect ways to find the correct mode (M1 or M2F1) in 2K/block image files implemented (cosmetic use more than anything else)
  • Work around that deals with older Plextor (and OEM) SCSI drives that don't implement Read TOC (full TOC) correctly. (this could mess up the track layout)
  • Removed looking for UDF on CD-i discs to speed up the mounting process (there's no UDF on these discs anyway)
  • Removed looking for UDF on true Whitebook VCD discs to speed up the mounting process (there's no UDF on these discs anyway)
  • Small changes in the ISO9660 interpreter to work around ISO9660 mastering bugs (by some apps)
  • Speed improvements in the "find lost UDF files and folders" scan in case of read errors.
  • Improved support for IDE interfaces with more than one bus. Sometimes, using SPTI, some devices were not found if not on the first bus.
  • Improvement to find if data is compressed or not on trashed Roxio created CD-RWs.
  • Improvement to still find the Sparable Allocation table on CD-RW if all references to that data are gone.
  • Several more little an subtile changes in the options, GUI, etc.

    Bug Fixes:
  • Time stamp on files sometimes wrong
  • The track size on DVD-R media (if only one track in one session containing less than 127,5 MB) could sometimes be wrong (depending on the device it was tested with)
  • Versions that come with HTML Help sometimes close with an exception error. This is now fixed.
  • Versions that come with HTML Help sometimes start with an exception error on a win95 or NT4 system with IE < 4.0. This is now fixed.
  • A very rare occurrence (only seen once but repeatable on that CD) of an exception error due to a corrupted UDF structure with unexpected value.
  • Flying folders (copy animation) was not always animated anymore (compiler issue)
  • Sometimes, during image file creation, when there were errors on the CD, and the image was spanning multiple tracks, and the option 'Always apply Selection' was checked, the selected way to process the error was not properly being applied in the following track (IF that track had errors).

Post a comment · Send to friend Comments · There are 3 additional comments
(2 replies) #1 figgy on 05 Nov 2003 - 03:01
I thought everything was off by default in Win 2003.
You have to explicitly enable the services that you require.

How is this new 'Security Lockdown Wizard' going to be different.
#1.1 SomeDork on 05 Nov 2003 - 06:50
The tool is designed to be basically a post-configuration analysis and repair.

For example, lets assume you want to get SMTP and POP3 going on a server. You configure a bunch of things to try to get it going (and in turn, turn on a lot of services). When it's all done, you can run this utility and have it close down exposed services that you didn't mean to activate, or that aren't useful anymore.

My understanding is that it will analyze your server and show you what is vulnerable and give you options for repair such as my example. Like it might say "You have File and Printer Sharing turned on ... it's not needed for SMTP/POP3". Just my 2c.

It's really useful IMHO as a once-over security tool. I'm sure the avid security nut will find fault with it, but I'd be completely happy if the tool were OVERLY ambitious rather than erring on the side of function. For example, using my example again, I'd like for the machine to simply turn off everything but port 110 and 25 and not really ask about anything else (unless I specified for it to be on specifically).
#1.2 system32 on 06 Nov 2003 - 04:58
Interesting. Thanks for the info!

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)