The one recommendation to make is that for DCs it's ok to use SCW to disable extra services you may not use on these machines (e.g. Error Reporting Service, Application Experience Lookup Service etc. ), however, you should not enable the Windows FW on DCs. If you do need to protect access to your DCs from other clients, a better recommendation is to use IPsec.
/Guido -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ken Schaefer Sent: Donnerstag, 28. Juli 2005 03:49 To: [email protected] Subject: RE: [ActiveDir] 2003 sp1 security agent SCW does more than just configure the Windows firewall. It can change service startup settings, configure registry keys around what auth types are used, configure your local security policy settings (SMB signing, auditing etc), and do an IIS lockdown. And it supports roll-back, so it's worth checking out. Also supports: a) analysis mode (compare server's actual configuration -vs- a proposed configuration) b) remote application mode (so you can apply polices to remote servers) c) command line support (so you can do this all via batch files) d) centralised storage of your policy files, so you can just update a single location with new XML files that all your SCWs should use. Cheers Ken : -----Original Message----- : From: [EMAIL PROTECTED] [mailto:ActiveDir- : [EMAIL PROTECTED] On Behalf Of Matt Brown : Sent: Thursday, 28 July 2005 7:56 AM : To: [email protected] : Subject: RE: [ActiveDir] 2003 sp1 security agent : : Ya, I mean the security config wizard. I've normally never had any : firewall : stuff on my domain controllers... But was thinking it might be possible : with : 2003 SP1. : : Anybody have any recommendations? : : : Thanks, : -- : Matt Brown [EMAIL PROTECTED] : Consultant for Student Technology Fee : website: http://techfee.ewu.edu/ : +--------------------------------------+ : | 509.359.6972 ph. - 509.359.7087 fx : | 307 MONROE HALL | Cheney, WA 99004 : +--------------------------------------+ : : : -----Original Message----- : From: [EMAIL PROTECTED] : [mailto:[EMAIL PROTECTED] On Behalf Of Rick Kingslan : Sent: Wednesday, July 27, 2005 9:26 AM : To: [email protected] : Subject: RE: [ActiveDir] 2003 sp1 security agent : : Security Config Agent.... Not sure on that. Do you mean the Security : Config Wizard? If so - nope - none at all. : : Rick : : -----Original Message----- : From: [EMAIL PROTECTED] : [mailto:[EMAIL PROTECTED] On Behalf Of Matt Brown : Sent: Wednesday, July 27, 2005 10:42 AM : To: [email protected] : Subject: [ActiveDir] 2003 sp1 security agent : : Anybody used the security config agent and had any issues with it on : Domain : Controllers... Or any recommendations? : : Thanks, List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
