HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\Posix

[james]

We have a *.ckr (Checker Script) file that was ran on a
Windows 2000 DC/AD controller and it seems that this key
was the problem. After running this *ckr file on our
existing *inf the machine had to be rebuilt.

HKLM\SYSTEM\CurrentControlSet\Control\Session
Manager\SubSystems\Posix

I checked the W2K Resource Kit and it states;

SubSystems
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager

Description
The SubSystems subkey contains entries for subsystems that
run on Windows 2000.

Caution

The entries in SubSystems are maintained by Windows 2000.
Do not change the value of these entries unless you are
directed to do so by a Microsoft Product Support
Specialist.

Can I confirm that this
HKLM\SYSTEM\CurrentControlSet\Control\Session
Manager\SubSystems\Posix seems to be harmful?

Thanks.

James

 

[Matt Scarborough]

On Fri, 18 Jul 2003 07:42:35 -0700, james wrote

We have a *.ckr (Checker Script) file that was ran on a
Windows 2000 DC/AD controller and it seems that this key
was the problem. After running this *ckr file on our
existing *inf the machine had to be rebuilt.

Sometimes this results from using a script or tool that doesn't understand the
values at
MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems
are of the type REG_MULTI_SZ

My understanding was that Checker Scripts were specific to WinNT and handled
only DWORD or Binary values. It does do well with handling errors like "if !=
DWORD goto next" IIRC.

Perhaps you can make the change for examples programmatically, or by using
Regedt32.exe, or by pushing out a Group Policy. Definitely Regedit.exe (not
regedt32.exe) also has issues with REG_MULTI_SZ values as well.

See the Windows 2000 Hardening Guide for some templates
http://www.microsoft.com/technet/security/prodtech/Windows/Win2kHG/06Tmplts.asp
http://www.microsoft.com/downloads/details.aspx?familyid=15e83186-a2c8-4c8f-a9d0-a0201f639a56

Matt Scarborough 2003-07-19