INFOSEC/NACOSA sec. templates and EXPANDING the AD SChema?

[Javier J]

INFOSEC/NACOSA sec. templates and EXPANDING the AD SChema?

Hi all!

Through a set of circumstances too long to mention, I have been tasked
with testing our company software in a domain hardened as per the
INFOSEC NACOSA 2.1 templates (ICN DC.inf, ICN Domain.inf,
InfosecCmdNS_srv_Ver2.1.inf / InfosecCmdNS_ws_Ver2.1.inf...)

The issue is, when the operating system is set up according to the
templates (as per the dc_w2ksec_install.doc - "COMPUSEC Technical and
Implementation Directive for Security Settings for Windows 2000 Domain
Controllers" ver 1.1, 15.Aug.2002), when I try to expand the AD schema
(using the Administrator account, that is a member of the Schema
Administrators Group), I get a security error stating that the account
can't do that.

IF I expand the AD Schema _before_ I set up all the templates, our
application runs just fine, but I need to know which are the settings
(if any) that are interfering with expanding the AD Schema, in order
to "see" how to revert them if possible, what is the impact of doing
so, etc etc.

I've been trying to find more info on the issue, but the web page that
the doc. refers to for further information
(http://cww.infosec.nato.int/compusec/Win2k_security/w2k_security.htm)
is not avaliable, and I haven't been able to find its "successor".

So, I'd be more than grateful if anybody with relevant knoweldge would
care to enlighten me. Maybe I'm not supposed to expand de AD Schema
FROM the DC? Maybe there is some security setting I have to tweak?...

I've found a page at microsoft that tells: "How to Reset User Rights
in the Default Domain Controllers Group Policy Object"
(http://support.microsoft.com/?id=267553), but I'm quite reluctant to
use such a "shotgun" approach.

Any and all help will be appreciate to an inordinate extent.

Thanks a lot for reading this far.

Javier J

 

[Roger Abell]

Instead of resetting to installation default per the KB you mention,
it is possible to use the Security Configuration and Analysis mmc
snapin to perform an analysis relative to the settings of that template.
One may then examine the results of the analysis to see differences
between the in-use settings and those that would be impose if the
template were applied.

 

[Stephen Cartwright [MSFT]]

You can use the Security Analysis and Configuration tool to compare the
existing settings against the template you want to use. That should indicate
where the differences are and what you might therefore need to "tweak" to
get the desired settings.
The NATO link you added, is that a local intranet link as its not visible.
NATO is a company now
Good luck.

 

[Javier J]

Hi!

First of all, thanks for the response.

In the end, the problem was not as "hard" as I feared.

These links:
http://www.microsoft.com/technet/pr...elp/F071D557-8B24-4161-81E4-DAF63D39595A.mspx
(Enable schema changes on a schema master running Windows 2000)

and
http://www.microsoft.com/resources/...s/2000/server/reskit/en-us/regentry/93494.asp

gave us a hint of what to do.

Just "enabling" this key was enough to be able to expand the schema.
The rest was easy

Thanks a lot