Securing the Windows 2000 Registry

As part of a system hardening routine and standard network policy, in Windows 2000, ACL permissions can be configured to limit a user access to keys that can be used by hackers or malicious programs.

Much like file permissions, ACLS can be configured on the registry through a couple of different ways. The easiest and most manual way is through the registry editor regedt32.exe. Regedt32.exe comes installed by default on most versions of Microsoft Windows with the exception of Windows 95/98/ME systems which only come bundled with the less functional regedit.exe. 

Regedt32 is different than its simpler cousin regedit.exe by its ability to allow the configuration of permissions or ACL’s (Access Control Lists) on specific registry keys.

FIGURE 1

Once regedt32 is launched, permissions can be viewed and configured by highlighting the hive or key you want to configure and navigating to the security>permissions menu. Once selected, users are giving a familiar menu by which permissions can be configured for groups as well as individual users.

FIGURE 2

Registry Auditing can also be turned for specific keys and subkeys using the advanced button in the permissions window.

FIGURE 3

With Active Directory, administrators can configure permissions using group policies. Registry permissions are manipulated using the “computer configuration>windows settings> registry” bucket. ACLS can be added manually per key, or a preconfigured template can be imported to configure multiple registry keys at once.

FIGURE 4

Once you have decided on which configuration tool is right for your organization, careful consideration should be made as to what permissions are appropriate for your environment as changing them will most definitely affect out of the box functionality. A proper test plan is highly recommended before making registry permission changes to a production environment.

A good starting point in hardening the registry would be to lockdown remote registry access. Network access to the registry is controlled by the Remote Registry Service which is installed by default in Windows 2000.  This service provides access to the Registry API and must be running on both the client and the target computer for network access to the registry to function. By default, in Windows 2000 only the Administrators and Backup Operators have permisions for network access to the registry.
 
As a good security practice, the remote registry service should be disabled on all servers and workstations. In addition, auditing should be turned on for the following registry key that controls ACL permissions for network registry access:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg

Once you have locked down remote access to the registry, ACL permissions should be hardened on specific keys that have security implications.

In accordance with the Common Criteria (CC) for Information Technology Security Evaluation http://csrc.nist.gov/cc/, Microsoft recommends locking down the registry by configuring the following keys:  

1. Tip: Never change SYSTEM permissions from Full Control in the Registry. Any changes to this permission will cause your system to fail upon reboot.
2. Tip: For added security, consider removing permissions for the Power Users Group if not in use.
3. Tip: For added security, consider replacing all permissions for Users and Everyone with Authenticated Users.

Active Directory administrators that are using a group policy security template can add the following lines to their .inf template file:

[Registry Keys]

"CLASSES_ROOT",0,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;CCDCLCSWRPSDRC;;;PU)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\SOFTWARE\Microsoft\OS/2 Subsystem for NT",0,"D:PAR(A;CI;KA;;;BA)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)"
"MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SYSTEM\CurrentControlSet\Services\EventLog",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers",2,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;CCDCLCSWRPSDRC;;;PU)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\Computername",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\Software\Microsoft\Windows NT\CurrentVersion",0,"D:AR(A;CI;KR;;;AU)"
"MACHINE\SOFTWARE\Classes\.hlp",0,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;CCDCLCSWRPSDRC;;;PU)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\SOFTWARE\Classes\helpfile",0,"D:PAR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;CCDCLCSWRPSDRC;;;PU)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\Software\Classes",0,"D:AR(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CIIO;KA;;;CO)(A;CI;CCDCLCSWRPSDRC;;;PU)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"
"MACHINE\Software",0,"D:PAR(A;CI;KA;;;BA)(A;CIIO;KA;;;CO)(A;CI;CCDCLCSWRPSDRC;;;PU)(A;CI;KA;;;SY)(A;CI;KR;;;BU)"

Reference:

The Windows 2000 Common Criteria Security Target
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/issues/W2kCCSCG/

Microsoft Knowledge Base Article - 153183
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/q153/1/83.asp&NoWebContent=1

Common Criteria for IT Security Evaluation
http://csrc.nist.gov/cc/