When you initially deploy a workstation, you typically configure the workstation according to your corporate security policy. Inevitably, though, these requirements change over time and older workstations may not be configured to comply with your new requirements. The challenge then becomes identifying which workstations have deficient configurations and which parts of the workstation's configurations need to be revised.
Sadly, there isn't a Windows feature that can
analyze every aspect of a workstation's security, but you can analyze the most relevant portions of a workstation's local security policy. To do so, you would simply use a properly configured workstation to create a security baseline. You can then compare that baseline against other computers on your network to see if they are properly configured.
Creating a security baseline for Windows Vista
Whether you want to analyze a workstation to test for incorrect security settings, or you want to correct security settings that are known to be wrong, the first step in the process is to create a security baseline. A security baseline is essentially a template that specifies how to set the various Group Policy settings.
There are two primary methods of creating a security baseline template in Windows Vista. The first method involves defining the template based on settings taken from a machine that is known to be configured correctly. To do so, log in as an administrator and follow these steps:
- Click the Start button and then select All Programs | Accessories | Run.
- Enter the MMC command at the Run Prompt.
- Click Continue if prompted by Windows Defender.
- When the management console opens, select the Add / Remove Snap-In command from the File menu.
- Select Group Policy Object from the list of snap-ins, and click the Add button.
- When prompted, verify that the Local Computer Policy is selected and click Finish, followed by OK.
- Navigate through the console tree to Local Computer Policy | Computer Configuration | Windows Settings | Security Settings, as shown in Figure A below.
- Right click on the Security Settings container and select the Export Policy command from the resulting shortcut menu
- When prompted, enter a name for the policy and click the Save button.
Figure A
Navigate through the console tree to Local Computer Policy | Computer Configuration | Windows Settings | Security Settings
An alternate method
If you don't want to create a baseline based on an existing configuration, then there is another option. Windows Vista allows you to create a security baseline template from scratch. To do so, follow these steps:
- Click the Start button and then select All Programs | Accessories | Run.
- Enter the MMC command at the Run Prompt.
- Click Continue if prompted by Windows Defender.
- When the management console opens, select the Add / Remove Snap-In command from the File menu.
- Select the Security Templates option from the list of snap-ins and click Add, followed by OK.
- When the console opens, there should be a security templates folder shown beneath the Security Templates container. The actual name and path of this folder will vary depending on how you are logged in, but right click on the security template folder and select the New Template command from the resulting shortcut menu.
- When prompted, enter a name and a description for the template that you are creating.
- Click OK, and the new template will be placed beneath the security templates folder, as shown in Figure B below.
- Now, populate the various security settings in the same way that you would if you were creating a Group Policy. Figure C below shows what this process looks like.
Figure B
The new template appears beneath the security template folder.
Figure C
You can populate the new template in the same way that you would populate a Group Policy.
Now that I have shown you how to create a security baseline template, it's time to put the baseline template to use. In my next tip on creating a security baseline, I will show you how to use the template that you have created to analyze Windows Vista workstations on your network and how to use the template to adjust and amend security problems that you may encounter.
About the author: Brien M. Posey, MCSE, is a Microsoft Most Valuable Professional for his work with Windows 2000 Server and IIS. He has served as CIO for a nationwide chain of hospitals and was once in charge of IT security for Fort Knox. As a freelance technical writer, he has written for Microsoft, TechTarget, CNET, ZDNet, MSD2D, Relevant Technologies and other technology companies.
