VA791-15-R-0020-001.pdf

DEPARTMENT OF

VETERANS AFFAIRS

O F F I C E O F I N F O R M A T I O N A N D T E C H N O L O G Y V A S E R V I C E D E L I V E R Y & E N G I N E E R I N G

E N T E R P R I S E S Y S T E M S E N G I N E E R I N G

VA Baseline Configuration Standard for Windows Server

Version 1.0

September 17, 2014 i

Revision History

Date Reason for Changes Version Author

9/17/2014 Final [For Release] 1.0.0 Hawkins

Contents 1 Purpose 2 Policy 3 Scope of authority 4 Responsibilities 5 Enterprise Versioning 6 Microsoft Enterprise Licensing

6.1 Approved license versions:

6.2 Key Management System

6.3 RDS/TS Client Access Licensing

6.4 Enterprise Server Licensing Usage

7 Procedures

7.1 VA Active Directory Integration

7.2 VA Standard Baseline Applications

7.3 Disk Partition Table Types

7.4 Administrative Remote Desktop Services (RD) Server

7.5 Required Roles/Features

7.6 Remote Administration

7.7 Windows Firewall

7.8 Hardware/Platform Agents

7.9 Platform Firmware Updates

7.9.1 Physical Platform

7.9.2 Virtual Platform

7.10 Requirement to Disable Unused Services/Software

7.11 IP version 6

7.12 Permissions

7.12.1 Share Permissions

7.12.2 File and Folder Permissions

7.13 Service Principal Names (SPN) and Service Accounts

7.13.1 Service Principal Names (SPN)

7.13.2 Service Accounts

7.14 System Administrators

7.15 Server Core (Minimal Interface)

7.15.1 Migrating from GUI to Core

7.15.2 Migrating from Core to Full GUI

7.16 Microsoft Internet Explorer

7.16.1 Internet Explorer Enhanced Security Configuration (IE ESC)

7.16.2 Uninstall Internet Explorer

7.16.3 Internet Explorer Group Policies

7.17 Application Best Practice

7.18 Vulnerability Remediation

7.19 Patch Installation

7.19.1 Minimum Service Pack Requirement

7.19.2 Minimum Patch Requirement

7.19.3 Embedded Application Patches

8 Feedback 9 References 10 Review Date 11 Follow-Up Responsibility Appendix A. Minimum Security Configuration Checklist

VA Baseline Configuration Standard for Windows Server

1 PURPOSE

The purpose of this policy is to provide guidance for the hardening of approved Windows Server versions for implementation into production within the VA environment. Included within this document is a security template to assist in the systems security posture, baseline configuration guide, and a configuration checklist. This policy will deliver improvements in the overall security of the operating system.

The objectives of this policy:

To produce a secure and less vulnerable network through ensuring the security of the systems within the network are correctly updated and secured.

To standardize the build and images across the Enterprise of all systems running Windows Server.

To assist in producing stable platforms to meet customer uptime/availability requirements.

2 POLICY

This policy is the VA Baseline Configuration Standard for Windows Server. It is for the standardization, stability and hardening of the Windows Server environment within the VA.

Please be aware this baseline document does not override any action items or actionable policy changes.

3 SCOPE OF AUTHORITY

The content and direction of this policy are in accordance with the VA Handbook 6500, Defense Information Systems Agency (DISA) Windows Server Checklists, National Institute of Standards and Technology (NIST) Checklists and Microsoft Windows Server Security Guide.

4 RESPONSIBILITIES

Material Weakness Guide Design: Enterprise Platform Engineering (EPE)

5 ENTERPRISE VERSIONING

This policy is a combined Windows Server baseline, including requirements for all currently supported Microsoft Windows Server versions within the VA.

The following versions are approved, with baseline compliance, for enterprise use:

- 2008 R2 (SP1)

- 2008 R2 (SP1) Core

- 2012

- 2012 Core

- 2012 R2 (Update)

- 2012 R2 (Update) Core

Approved with listed constraints:

- 2008 x86 (non-core) is approved for SCCM 2007 infrastructure only. No new non-SCCM installations.

- 2003 is approved for existing installs only. No new installations without approved waiver.

- 2003 R2 is approved for existing installs only. No new installations without approved waiver.

For Server 2003 systems, end of support has been announced as July 2015. It is the system and application owners’ responsibility to plan migration of these resources to an approved version.

The following versions are not approved:

All new release versions not on the approved list are not allowed – without exception. This includes Service Pack increments to existing baseline versions.

The following versions are no longer maintained and must be isolated or removed from VA infrastructure:

- Server 2000 including all appliance versions of Windows 2000 and older.

6 MICROSOFT ENTERPRISE LICENSING

The VA Microsoft Enterprise License Agreement allows licensing Microsoft Windows Server versions. The Ruthless Reduction Taskforce requires Microsoft true-up be completed evaluating VA license usage. Where possible, Microsoft Server should be consolidated to leverage virtualization license benefits and discontinue use of unnecessary Windows Server installations. Test and Dev environments should be limited where determined unnecessary.

Reference http://vaww.ips.med.va.gov/MS_CLA/Microsoft-ELA.htm for Microsoft Enterprise Agreement questions.

6.1 APPROVED LICENSE VERSIONS:

Server Version License Benefit

Windows Server 2008 (R2) Enterprise Edition Allows unlimited VM license benefits per host

Windows Server 2012 (R2) Standard Edition Allows 2 for 1 VM license benefits per host

No other versions are licensed at this time.

Please note 2012 (R2) Datacenter edition is not on the enterprise agreement. No datacenter editions should be used in the VA. Standard should be the only licensed edition.

6.2 KEY MANAGEMENT SYSTEM

VA KMS servers should be used to activate KMS releases of MS Server. The activations should be automatic. If a manual activation is needed, use: vhar04app17.vha.med.va.gov

Example:

slmgr.vbs /skms vhar04app17.vha.med.va.gov slmgr.vbs /ato

6.3 RDS/TS CLIENT ACCESS LICENSING

ALL Remote Desktop/Terminal Servers will leverage Per Device licenses.

tslicense.va.gov will be used for all TS/RDS CAL management across the enterprise.

No independent TS/Remote Desktop license servers will be approved.

6.4 ENTERPRISE SERVER LICENSING USAGE

All installations of Windows Server should by default use the VA Enterprise Agreement media and installation keys.

The only exceptions to this rule:

- Isolated VENDOR supported medical devices. These are not managed or maintained by OIT, often called ‘turn-key’ and are considered ‘industry’ servers. These installations will require separate Microsoft Server licensing including server client access licensing AND maintenance support agreements.

- Isolated non-Domain non-OIT supported installations. These installations require a waiver; these installations do not meet VA Microsoft license agreements and require licensing as outlined above.

Examples of servers that will use VA Microsoft Enterprise Agreement:

- All OIT supported Servers regardless of application owner

- All non-isolated medical servers, these servers are domain joined for license visibility and meet VA EA license requirements

- All OIT owned and managed medical application servers, regardless of isolation status (ex: VBECS).

If server role and license use is undetermined by the above categories, IT vs Non-IT funding categories should be used to determine OPERATING SYSTEM funding source. If the operating system funding source is IT, use the Enterprise License Agreement. If OIT is NOT the operating system source, the system owner must purchase the Operating System and associated licensing through non-OIT funding.

http://vaww.ips.med.va.gov/MS_CLA/Microsoft-ELA.htm

7 PROCEDURES

The following section will provide configuration requirements and is to be used as a list in conducting a review of the Windows Server systems for Security Readiness Review process. All procedures are required, unless noted.

All servers are required to comply with the Virtualization First memorandum. All new systems must be hosted on a virtual platform or have an approved waiver.

Systems that use a non-approved operating system version must comply with the applicable portions of this baseline. Ex: IP Helper does not apply to Server 2003. GPO requirements apply to Server 2003.

Where possible, version specific configuration requirements are listed.

7.1 VA ACTIVE DIRECTORY INTEGRATION

Windows Server must be added to the applicable VA.gov domain to ensure the appropriate Group Policy Objects (GPO's) are applied to the servers. VA mandatory GPOs provide a significant portion of the baseline security lockdown.

Required VA Group Policy objects should be assigned to all Microsoft Servers. WMI filters should be applied as required to target specific systems.

Reference:

https://vaww.portal.va.gov/National_Sites/CIS/Wiki/Wiki%20Pages/GPO%20- %20Group%20Policies%20Managed%20Nationally.aspx

7.1.1 MACHINE ACCOUNT INITIAL LOCATION

To allow immediate application of the required GPOs, the Computer account for the server should be pre-staged or created in the appropriate Domain OU.

No server machine accounts should be maintained in the default computer OU (Mismanaged Accounts\Computers).

7.1.2 WORKGROUP AND NON-VA.GOV DOMAIN SYSTEMS

All workgroup systems must have a waiver. Workgroup systems are usually tenant or medical devices behind MDIA.

All workgroup systems must have a waiver completed and filed with the system configuration. Workgroup systems are a direct vulnerability associated with both audit and password policy controls and FISMA standards. This waiver is required regardless of application owner.

Temporary workgroup membership during imaging/provisioning, rename and troubleshooting do not require waivers as long as this is a temporary (less than 24 hour) status.

All non-VA.GOV systems including DMZ and hosted datacenters must have a waiver on file. Non-VA.gov systems do not employ enterprise security controls, standardization, auditing and 2FA requirements. Currently the ONLY exceptions to VA policy that allow non-VA.gov systems are DMZ and external hosted datacenter resources. All system implementations using non-VA.GOV systems must have a waiver on file. NCCB approval is required for all non-VA.GOV waivers; routing process for non-VA.GOV system waivers should also include VA IT Engineering CIS Directory Services <VHAETMADTeam@va.gov>. Waiver approval may be redacted or withdrawn by National at any time for advancements in National compatibility and Federation models.

For complete AD and AD collocated system requirements, please review:

Core Systems Wiki: https://vaww.sde.portal.va.gov/sites/fo/committees/coresystems/Wiki/Forms/AllPages.aspx CIS Knowledge Base: https://vaww.portal.va.gov/National_Sites/CIS/Wiki/Wiki%20Pages/Forms/AllPages.aspx AD Standards Product Documentation:

https://vaww.sde.portal.va.gov/sites/fo/committees/coresystems/AD%20Standardization/Forms/AllItems.aspx?RootF older=%2Fsites%2Ffo%2Fcommittees%2Fcoresystems%2FAD%20Standardization%2FStandards%20Development%20P roject%5FDocumentation

7.2 VA STANDARD BASELINE APPLICATIONS

These applications are required to be installed on all baseline Windows Server installations.

Current VA tested/approved Visibility to Server (V2S) Application Suite:

https://vaww.portal.va.gov/National_Sites/CIS/Wiki/Wiki%20Pages/GPO%20-%20Group%20Policies%20Managed%20Nationally.aspx https://vaww.portal.va.gov/National_Sites/CIS/Wiki/Wiki%20Pages/GPO%20-%20Group%20Policies%20Managed%20Nationally.aspx https://vaww.sde.portal.va.gov/sites/fo/committees/coresystems/Wiki/Forms/AllPages.aspx https://vaww.portal.va.gov/National_Sites/CIS/Wiki/Wiki%20Pages/Forms/AllPages.aspx https://vaww.sde.portal.va.gov/sites/fo/committees/coresystems/AD%20Standardization/Forms/AllItems.aspx?RootFolder=%2Fsites%2Ffo%2Fcommittees%2Fcoresystems%2FAD%20Standardization%2FStandards%20Development%20Project%5FDocumentation https://vaww.sde.portal.va.gov/sites/fo/committees/coresystems/AD%20Standardization/Forms/AllItems.aspx?RootFolder=%2Fsites%2Ffo%2Fcommittees%2Fcoresystems%2FAD%20Standardization%2FStandards%20Development%20Project%5FDocumentation https://vaww.sde.portal.va.gov/sites/fo/committees/coresystems/AD%20Standardization/Forms/AllItems.aspx?RootFolder=%2Fsites%2Ffo%2Fcommittees%2Fcoresystems%2FAD%20Standardization%2FStandards%20Development%20Project%5FDocumentation

McAfee VirusScan Enterprise

McAfee Host Intrusion Prevention

McAfee ePolicy Agent

System Center Configuration Manager Client

IBM Endpoint Manager Agent (Tivoli/Bigfix)

Simple Network Management Protocol (SNMP) Service and string configured per V2Everything(V2S/E)

EnCase

Current VA tested/approved 2 Factor Authentication (2FA) application list:

SafeNet eToken Drivers

ActivClient

ActivClient is required on systems that participate in Smartcard (PIV/CAC) or concurrent/multiple user session authentication (RDS/TS implementations). RDS/TS requirement also applies to administrative servers.

Version information:

Application owners for the specific application maintain required version information. Version information is excluded from this baseline to prevent delays in application patching.

Action Item release for software programs may supersede this list. This list is considered the minimum requirement. All related services must remain automatic start and running during system operation.

7.3 DISK PARTITION TABLE TYPES

For Windows Server 2008 and up, Globally Unique Identifier (GUID) Partition Table (GPT) is the default if the system uses User Extensible Firmware Interface (UEFI). Note that UEFI systems cannot be migrated/converted from physical to virtual (P2Vd) without significant effort.

Vendors allow BIOS compatibility mode to allow backwards compatibility.

Some backup products do not support GPT

7.4 ADMINISTRATIVE REMOTE DESKTOP SERVICES (RD) SERVER

Consolidated Administrative Remote Desktop Session Hosts should be utilized vs Desktop installations of Server role/feature management and administrative tools. Administrative servers are specifically for remote management of enterprise servers. These servers should be consolidated at the highest organizational level possible (ex: Region level).

Site based administrative servers should be decommissioned.

These servers should be utilized for all activities requiring role or NMEA accounts.

Roles this server can be used for:

- AD Management

- Exchange Management

- Server Management

- Specific use application management

Ex: specialized national servers exist for Token and SIP management across the enterprise.

Reference: https://vaww.portal.va.gov/National_Sites/CIS/Wiki/Wiki%20Pages/BEST%20PRACTICES%20- %20AD%20Administration.aspx

7.5 REQUIRED ROLES/FEATURES

Several roles/features are required for enhanced system management and VA V2S/E compliance.

Required Server Roles/Features:

- SNMP Service

- Group Policy Preference Client Side Extensions (2003) https://vaww.portal.va.gov/National_Sites/CIS/Wiki/Wiki%20Pages/BEST%20PRACTICES%20-%20AD%20Administration.aspx https://vaww.portal.va.gov/National_Sites/CIS/Wiki/Wiki%20Pages/BEST%20PRACTICES%20-%20AD%20Administration.aspx

- Windows Management Framework Core, WinRM &PowerShell 2.0+ (2003, required for enhanced management)

- PowerShell 3.0 (2008 R2+, required for enhanced management)

7.6 REMOTE ADMINISTRATION

Windows allows for advanced remote administration including PowerShell, remote WMI, Management Consoles and Remote Desktop.

As a general rule, Remote Administration and Management should be enabled where possible.

1. Enable Remote Desktop Protocol (RDP)

2. Network Level Authentication (2008+ NLA required)

3. Enable Remote Management Tools

4. Enable PSRemoting and Remote-Signing

5. Enable Windows Remote Management (WinRM 2.0+ required).

6. Enable all remote management tools through Windows Firewall Service (Regardless of Firewall status)

7. Enable Remote Management tools of Firewall Service (Regardless of Firewall status).

For systems with any port 80 presentation to public networks modify the default WinRM listener from port 80! By default WinRM 1.1 systems use port 80. By default WinRM 2.0 uses 5985. If a computer is upgraded from 1.1 to 2.0, port 80 will still be configured as a listener!

7.6.1 ENABLE REMOTE MANAGEMENT AND ADMINISTRATION

These procedures are for 2008+ with WinRM and PS already installed.

Enable RDP with NLA/Secure Requirement, note WMI namespace is cimv2 vs cimv2\Terminal Services on 2003.

a. (Get-WmiObject -Class "Win32_TerminalServiceSetting" -Namespace root\cimv2\terminalservices).SetAllowTsConnections(1)

b. (Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -Filter

"TerminalName='RDP-tcp'").SetUserAuthenticationRequired(1)

c. netsh firewall set service type = remotedesktop mode = enable

Enable WinRM (Enables WinRM, PowerShell Remoting, Remote WMI and required Firewall Exceptions)

a. Set-WSManQuickConfig

b. Winrm qc

If Windows Firewall is disabled, winrm qc will fail. Enable Windows Firewall temporarily or manually enable required services.

Enable Remote Signing (Required to execute remote scripts within Powershell) Set-ExecutionPolicy -ExecutionPolicy remotesigned

Reference: http://msdn.microsoft.com/en-us/library/aa384372(VS.85).aspx http://blogs.technet.com/b/jonjor/archive/2009/01/09/winrm-windows-remote-management-troubleshooting.aspx

Currently WinRM and WinRS policies are not configured via National GPO; recommend using organization GPOs to configure Windows Firewall, Firewall Exceptions, Windows Remote Management, Remote Desktop and Remote Scripting options.

7.7 WINDOWS FIREWALL

Out of the box, Windows Firewall and Advanced Firewall block required VA security software. The Windows Firewall service MAY be disabled on all VA V2S compliant servers. V2S compliance status is determined by McAfee Agent, Virus Scan and Host Intrusion Prevention installation and operation status. If all 3 V2S McAfee baseline products are installed and maintained, the Windows Firewall service may be disabled.

http://msdn.microsoft.com/en-us/library/aa384372(VS.85).aspx http://blogs.technet.com/b/jonjor/archive/2009/01/09/winrm-windows-remote-management-troubleshooting.aspx

In no instance should the Firewall Service and HIPS be disabled or not installed. Please comply with all application baseline configuration requirements. VA Windows application baselines should include protection by this Windows Server policy with an amended V2S policy. In all cases, either Windows Firewall or HIPS should protect the system network visibility state.

7.7.1 ADD REQUIRED EXCEPTIONS

Add required Firewall exceptions, including:

- TCP/UDP 4445 for EnCase and SVCHOST32 executable.

netsh advfirewall firewall add rule name="Allow Outbound Port 4445 TCP" dir=out localport=4445 protocol=TCP action=allow netsh advfirewall firewall add rule name="Allow Outbound Port 4445 UDP" dir=out localport=4445 protocol=UDP action=allow netsh advfirewall firewall add rule name="Allow Inbound Port 4445 TCP" dir=in localport=4445 protocol=TCP action=allow netsh advfirewall firewall add rule name="Allow Inbound Port 4445 UDP" dir=in localport=4445 protocol=UDP action=allow netsh advfirewall firewall add rule name="Allow Encase Out" dir=Out program="%systemroot%\system32\SvcHost32.exe" action=allow

- Remote Desktop Protocol netsh firewall set service type = remotedesktop mode = enable

- Remote Management (WinRM) Multiple groups are required for WinRM Firewall exceptions. NETSH is being used in this example for universal compatibility.

netsh advfirewall firewall set rule group=”Windows Firewall Remote Management” new enable =yes netsh advfirewall firewall set rule group=”remote administration” new enable=yes netsh advfirewall firewall set rule group=”Remote Event Log Management” new enable=yes netsh advfirewall firewall set rule group=”Remote Services Management” new enable=yes netsh advfirewall firewall set rule group=”File and Printer Sharing” new enable=yes netsh advfirewall firewall set rule group=”Remote Scheduled Tasks Management” new enable=yes netsh advfirewall firewall set rule group=”Performance Logs and Alerts” new enable=yes netsh advfirewall firewall set rule group=”Remote Volume Management” new enable=yes

Use the winrm qc as the primary method of WinRM Firewall exception creation. The version of WinRM installed may require port 80 (for limited cases of 1.1 and 1.1>2.0 upgrade

References: http://technet.microsoft.com/en-us/library/hh831755.aspx

7.7.2 DISABLE WINDOWS FIREWALL

Again, we do not recommend disabling Windows Firewall. This is a system owner/organizational decision. If the firewall is disabled, the previous exceptions in 7.7.1 must be created prior to disabling the Firewall service.

Exception creation is required to prevent accidental or intentional disabling of remote management.

- Disable Windows Firewall netsh advfirewall set profiles state off netsh firewall set opmode disable

7.7.3 PUBLIC VS DOMAIN NETWORK PROFILES

By default, if the connected network is identified either automatically or manually as ‘Public’ many management tools are limited to the local subnet. Manually remove local subnet limitations and expand to 10.x or modify the network identification to ‘Domain Network’ or ‘Work Network’.

7.8 HARDWARE/PLATFORM AGENTS

As necessary, hardware and platforms agents should be installed and maintained by operations. Examples of Hardware/Platform Agents include:

-Hardware platform CIM providers for OpenManage, System Director, etc.

-VMware Tools -Microsoft Hyper-V Integration Services http://technet.microsoft.com/en-us/library/hh831755.aspx

7.9 PLATFORM FIRMWARE UPDATES

7.9.1 PHYSICAL PLATFORM:

To maintain operating system security and stability, the platform hardware components should be maintained to minimize security vulnerabilities and stability issues. ESE does not manage server platform firmware release or installation. Occasional system software or firmware vulnerabilities are identified requiring field remediation.

Vendor and operating system compatibility should be tested and applied following organization procedures.

7.9.2 VIRTUAL PLATFORM:

The virtual hardware version (ex: VMware Hardware version) should be maintained at the highest level compatible with the operating system and environment. Reference the applicable Virtual Guest baseline as appropriate.

7.10 REQUIREMENT TO DISABLE UNUSED SERVICES/SOFTWARE

Disabling unnecessary services within Windows Server greatly reduces the risk of security vulnerabilities. Necessary services will vary depending on how the system will be configured.

The following services and/or features are to be disabled if they are not required:

- IP Helper (iphlpsvc)

7.11 IP VERSION 6

On Windows 2008+ systems, IPv6 must be enabled to maintain system function and stability. Unbinding the protocol from the network adapter will create an unstable and unpredictable system.

If system certification or a collocated application requires IPv6 be disabled, please disable properly.

Reference:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;929852 http://technet.microsoft.com/en-us/network/cc987595.aspx

7.12 PERMISSIONS

The Principle of Least Privilege (PoLS) requires all file and folder permissions be limited to the rights needed to perform function.

7.12.1 SHARE PERMISSIONS

All shares should have the minimal share permissions needed to maintain function. ‘Everyone’ share permissions require a waiver maintained with either the application baseline or system configuration documentation.

‘Authenticated users’ should be used as a last resort vs default permission. Specific security group membership should be used.

7.12.2 FILE AND FOLDER PERMISSIONS

All file and folder permissions should maintain prepopulated System user and Administrator group permissions.

Specific cases may require these permissions be removed but may limit recoverability and auditing records on the files.

In all cases where traditional users will access the files, directly or through shares, the ‘Full Control’ permission should be limited to only justifiable cases. The ‘Modify’ permission should be used where needed vs Full Control.

7.13 SERVICE PRINCIPAL NAMES (SPN) AND SERVICE ACCOUNTS

7.13.1 SERVICE PRINCIPAL NAMES (SPN)

SPNs should be used where possible to limit service account creation and permission delegation. SPNs may be used for service start accounts, Kerberos authentication, etc.

SPNs should not be delegated rights beyond those necessary to maintain function. This includes SPN rights on the parent machine account.

SPNs should be utilized for Failover Clustering active directory permissions. SPN permissions will help automate cluster failover and common DNS/machine account issues related to virtual name creation and maintenance.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;929852 http://technet.microsoft.com/en-us/network/cc987595.aspx

7.13.2 SERVICE ACCOUNTS

Service Accounts are manually created minimal right user accounts. Local service accounts MUST be avoided, domain accounts should be used. Domain service accounts must comply with VA Domain Standardization guidance. Service accounts with local administrator permissions should be limited to cases with absolute justification!

All service accounts should comply with VA 6500 service account password requirements without exception.

Service account permissions should be limited to the rights required to maintain application or system function.

Service accounts should be limited to console login where absolutely necessary to maintain the application. In cases where console login is required, the account should be limited to only the machine accounts needed.

7.14 SYSTEM ADMINISTRATORS

The Principle of Least Privilege also applies to user account permissions.

Two-factor Authentication (2FA) users - Administrators should be limited to NMEA, token accounts. Mail enabled accounts including the ‘regular’ accounts should not be added as administrator or delegated any remote administrator rights.

Role-based accounts – Role based accounts allow non-token enabled accounts permission delegation. These accounts SHOULD NOT have local administrator rights on servers without explicit justification. Explicit justification may be limited to MDIA, non-OIT owned equipment, or elevated rights application requires local administrator access. In no scenario should regular user accounts be substituted for access.

Role based accounts allow application administration of non-2FA compatible applications. In all cases of role based account delegation, national waiver or ePAS completion is required.

Traditional user accounts – Regular user accounts, including mail enabled accounts, should not have delegated administrative rights to the server including role based administration.

Service accounts – Service accounts including SPNs should be limited to the permissions needed to maintain function.

The rights should be delineated; example SQL SA account should not be added to the local system administrator group.

7.15 SERVER CORE (MINIMAL INTERFACE)

On Windows 2008+ systems a Core minimal-GUI option is available for Windows installations. With 2008 implementations you cannot move between CORE and GUI implementations; reinstallation is required.

Beginning with 2012, moving from GUI to Core installation is supported. 2012 also introduced Server Core Minimal Interface. Minimal interface includes management console features to allow local management outside of sconfig.

Server Core currently supports the following server roles:

- Active Directory (AD) and AD Lightweight Directory Services (AD LDS)

- DHCP Server

- DNS Server

- File Services

- Hyper-V

- Print Services

- Streaming Media Services

- Web Server (IIS)

- Active Directory Certificate Services

To minimize the attack surface of Server implementations all compatible high risk, public facing 2012+ Servers will be transitioned to Core (minimal interface) after application installation.

It is recommended all compatible FISMA High systems be transitioned to Core (minimal interface).

National application specific baselines may require Server Core regardless of implementation location.

7.15.1 MIGRATING FROM GUI TO CORE

After application installation and initial testing, remove the ‘Server Graphical Shell’. Removing these roles can be performed via PowerShell, dism or the GUI server management console. A reboot is required.

To migrate to full Core (vs Minimal Interface) remove the ‘Graphical Management Tools’.

7.15.2 MIGRATING FROM CORE TO FULL GUI

Troubleshooting or installation/upgrade of an application may require temporarily reverting to the Full GUI install.

Using remote tools or sconfig reinstall ‘Server Graphical Shell’ and ‘Graphical Management Tools’. A reboot is required.

7.16 MICROSOFT INTERNET EXPLORER

Internet Explorer use should be limited on Windows Server implementations.

The VA employs the Principle of Least Privilege to user accounts. Internet Explorer may allow inadvertent installation of malware on Server implementations. If an administrator inadvertently causes a malware infection; all system users and possibly interconnected systems may be infected.

Care should be taken to prevent use of Internet Explorer.

7.16.1 INTERNET EXPLORER ENHANCED SECURITY CONFIGURATION (IE ESC)

In all cases of Internet Explorer use on Servers, IE ESC should remain enabled for administrators. The only exceptions are administrative servers (RDS Admin Servers). The role should remain intact and installed (not removed on 2003 implementations).

7.16.2 UNINSTALL INTERNET EXPLORER

Internet Explorer is included in all Windows Server GUI installations. Server Core installations do not include Internet Explorer.

Internet Explorer should not be removed on Server 2003 as it is required by Windows Updates and Windows Explorer integration.

Internet Explorer can be removed from all 2008+ systems where possible. Removing Internet Explorer does not remove the requirement for application and system patches. All patches still show as required.

7.16.3 INTERNET EXPLORER GROUP POLICIES

All Remote Desktop (ex: XenApp, App-V, etc.) implementations require National client Internet specific group policies be applied. This includes application and trusted site group policy objects. Follow all XenApp application baseline requirements for these servers.

These group policies apply security and add-on lockdowns to prevent both inappropriate use and possibly malware infections.

Server specific group policies are not created; copies should be created with the appropriate WMI filter. [Server] should be added to the end of the copied GPO. RDS/TS servers should be segregated via OU where Internet Explorer policy objects interfere with system function.

Reference:

https://vaww.portal.va.gov/National_Sites/CIS/Wiki/Wiki%20Pages/GPO%20- %20Group%20Policies%20Managed%20Nationally.aspx

7.17 APPLICATION BEST PRACTICE

This document outlines the requirements for the Operating System configuration only. Applications and roles installed on top of the operating system need security analysis and compliance with applicable VA and vendor baselines and documentation. Microsoft provides multiple engines to provide best practice analysis and security compliance.

Microsoft Baseline Security Analyzer (MBSA) and Best Practice Analyzers (BPA) should be used and are outside the scope of this document.

Ensure the latest version of the applicable tool is used. This may require running Windows Update to pull the latest version. Other VA approved mechanisms include SCCM Desired Configuration Management.

https://vaww.portal.va.gov/National_Sites/CIS/Wiki/Wiki%20Pages/GPO%20-%20Group%20Policies%20Managed%20Nationally.aspx https://vaww.portal.va.gov/National_Sites/CIS/Wiki/Wiki%20Pages/GPO%20-%20Group%20Policies%20Managed%20Nationally.aspx

7.18 VULNERABILITY REMEDIATION

The VA uses Nessus Tenable Scanner to identify vulnerabilities associated with the operating system and installed applications.

Applications that are not part of the VA Windows Server Baseline including NET, ASP, IIS, Java, Adobe products should not be installed unless required! These applications present the largest portion of Server vulnerabilities requiring timely often manual remediation. Vulnerabilities should be addressed in the timelines outlined by Action Items or actionable VA policy changes.

7.19 PATCH INSTALLATION

7.19.1 MINIMUM SERVICE PACK REQUIREMENT

All templates and application development should be performed off the embedded service pack media.

New service packs are considered a baseline modification as the build number is modified. Do not install a Windows Server service pack until baseline approval through NCCB is complete.

Server Version Service Pack/Major Patch

Windows Server 2003 2

Windows Server 2003 R2 2

Windows Server 2008 2

Windows Server 2008 R2 1

Windows Server 2012 N/A

Windows Server 2012 R2 Update

For Windows 2012 R2, an update called ‘2012 R2 Update’ KB2919355 is considered the latest major release. Reference: http://support.microsoft.com/kb/2919355

7.19.2 MINIMUM PATCH REQUIREMENT

National Change Board approval is performed for applicable Microsoft Windows patches following release. At the time of this baseline approval, all released Microsoft Server patches are approved.

SCCM is the approved Windows Server patching mechanism, Update lists are created for each Change Request.

National SCCM Reports are available to verify compliance.

7.19.3 EMBEDDED APPLICATION PATCHES

Remote Desktop Server (ex: XenApp) implementations should mirror the application baseline requirements from Desktop Technologies and the application specific baseline.

7.19.3.1 INTERNET EXPLORER

Vulnerability assessments and end of life support for Internet Explorer define the requirement to run the latest compatible Internet Explorer version. IE8 is considered the minimum baseline version approved for VA Servers.

TRM is the correct tool to find minimal Internet Explorer versioning.

7.19.3.2 .NET FRAMEWORK

Many applications require .NET installation. This Windows Server baseline requires PowerShell installation on the OS.

PS requires the compatible version of .NET depending on the operating system. Non-Standard .NET patches may not be included in National change requests.

http://support.microsoft.com/kb/2919355

8 KNOWN ISSUES

The following section outlines known issues with Windows Server operating systems within the VA.

8.1 SMB VERSION 3 WAN TRAFFIC

SMB Version 3 (SMB3) traffic over CIFS/SMB latency optimized WAN links does not succeed with Riverbed RIOS VA baseline version 7.0.5D. Administrators and end users may receive time-outs or application errors. The system event logs may indicate connection resets or connection timeouts between SMB3 client/server communications.

Network traces may identify significant TTL increase in transit and packet ID modification. This only impacts SMB3 client/server communication (Windows 2012+/8+ to 2012+/8+).

Impact: SMB version 3 is the default SMB protocol used on Windows Server 2012 and 2012 R2. SMB3 is used for many roles and is the required SMB version for many Windows Server 2012+ features. System Administrators may not be able to manage or use specific features on servers over the latency optimized links to include Win RM, Remote WMI, Branch Cache, SQL Always On, and Hyper-V Replica.

Workaround(s): An enterprise testing and deployment plan is in progress for upgrading Riverbed infrastructure to remediate this issue. Please contact your organization WAN team for details.

If deploying Windows Server 2012/R2 over a WAN latency optimized link, test function and use Remote Desktop to perform administrator functions on the server.

Consider modifying the deployment plan to temporarily cross Riverbed management boundaries, preventing latency acceleration.

Disabling SMB3 disables all SMB2 functionality with the systems; breaking local loopback management and affects system stability. Do not disable SMB3.

Disabling CIFS latency optimization over WAN may negatively impact user performance as it disables all CIFS/SMB latency optimization including Server 2003-2012 client/server communication. Do not disable latency optimization

9 FEEDBACK

Please send baseline feedback to our ESE Platforms Feedback Portal:

http://vaww.eie.va.gov/SysDesign/Lists/Baseline%20Discussion/ Feedback includes questions, comments and recommendations for change.

10 REFERENCES

- Windows Server Security Guide: http://www.microsoft.com/downloads/details.aspx?FamilyID=fb8b981f- 227c-4af6-a44bb115696a80ac&DisplayLang=en

- Microsoft Threats and Countermeasures: http://technet.microsoft.com/en-us/library/hh125921(v=ws.10).aspx

- VA naming standards: http://vaww4.va.gov/NamingConventions

- Windows Server Security Baseline: http://technet.microsoft.com/en-us/library/gg236605.aspx

- VA Handbook 6500, Information Security Program:

http://vaww.va.gov/vapubs/viewPublication.asp?Pub_lD=364&FType=2

- Multiple references included throughout the document.

11 REVIEW DATE

September 2015

12 FOLLOW-UP RESPONSIBILITY

Approval: Yes / No Executive Director Date of Approval:

http://vaww.eie.va.gov/SysDesign/Lists/Baseline%20Discussion/ http://www.microsoft.com/downloads/details.aspx?FamilyID=fb8b981f-227c-4af6-a44bb115696a80ac&DisplayLang=en http://www.microsoft.com/downloads/details.aspx?FamilyID=fb8b981f-227c-4af6-a44bb115696a80ac&DisplayLang=en http://technet.microsoft.com/en-us/library/hh125921(v=ws.10).aspx http://technet.microsoft.com/en-us/library/hh125921(v=ws.10).aspx http://vaww4.va.gov/NamingConventions http://technet.microsoft.com/en-us/library/gg236605.aspx http://vaww.va.gov/vapubs/viewPublication.asp?Pub_lD=364&FType=2

Appendix A. MINIMUM SECURITY CONFIGURATION CHECKLIST

This section includes the minimum security configuration checklist. Review the specific operating system requirements below. An asterisk (*) indicates an optional configuration item or review the specific configuration requirements for your implementation.

Configuration Item: 2003 (R2) 2008+ Core 2008+ GUI

VA.GOV Requirements X X X

- Domain Joined X X X

- VA Activated X X X

- RDS CALs use tslicense.va.gov X N/A X

- Correct OU Requirement X X X

- Default GPOs X X X

V2S/E Suite X X X

- McAfee VirusScan Enterprise X X X

- McAfee Host Intrusion Prevention X X X

- McAfee ePolicy Agent X X X

- System Center Configuration Manager Client X X X

- IBM Endpoint Manager Agent (Tivoli/Bigfix) X X X

- SNMP Service X X X

- SNMP Read Only String X X X

- EnCase X X X

2FA Requirement X X X

- SafeNet eToken Drivers X X X

- ActivClient * N/A *

Required Roles X

- GPP Client Side Extensions X

- WinRM 2.0+ X X X

- PowerShell 2.0+ X X X

Remote Administration (if required) * * *

- RDP X X X

- NLA Required

X X

- Remote Management Tools (WinRM) X X X

- PSRemoting X X X

- Remote-Signing X X X

- WinRM Firewall Rules X X X

- RDP Firewall Rules X X X

- EnCase specific Firewall Rule X X X

Hardware Agents X X X

- Physical Server Agents X X X

- Virtual Server Agents X X X

Disable Unused Services

- Disable all installed, unneeded services X X X

- Disable IP Helper Service

Configuration Item: 2003 (R2) 2008+ Core 2008+ GUI

Leave IPv6 Enabled

Permissions X X X

- Lock Down Share Permissions X X X

- Lock Down File/Folder Permissions X X X

SPNs/Service Accounts: X X X

- Use SPNs where possible X X X

- Limit SPN rights X X X

- Limit Service Account use X X X

- Limit Service Account rights X X X

System Administrators X X X

- Use 2FA Tokens X X X

- Limit Local Administrators X X X

- Limit RBA use and rights X X X

- Limit Admin Account Permissions X X X

- Limit Regular Account Permissions X X X

Server Core Requirement

Microsoft Internet Explorer

- IE ESC for Administrators (by default) X

X

- IE ESC for Users (by default) X

- Remove IE (if necessary):

Remediate identified vulnerabilities X X X

Maintain Minimum Patch Version X X X