Print Server Security Template (.inf)

[adfreak]

Hi,

In the Windows 2003 Security guide, they give templates for each server
role. I would like to implement the Print Server one via a GPO linked to my
Printers "OU". I noticed that it only changes two settings from that of the
Member Server Baseline.inf file which is setting the Print Spooler service
to "Automatice" versus "Disabled" and the other is a security option. It
sets "Microsoft network server: Digitally sign comunications (always) =
disabled"

I was wondering if someone could help me out and explain why that has to be
set to disabled?

Thanks

 

[Steven L Umbach]

My guess is for compatibility with some downlevel clients [W9X for instance and maybe
NT4.0] which by default could not comply with SMB signing. There are also some known
issues with XP SP1 and smb signing though I know that would not be an official reason
and there is a fix by request only. W2K and XP Pro clients will be default still
attempt smb signing. The link below may be of help. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;823659 --- read paragraph
6.
http://support.microsoft.com/default.aspx?scid=kb;en-us;555038 --- possible
alternate solution
http://support.microsoft.com/default.aspx?scid=kb;en-us;810907